CVE-2020-26829: SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of…

PriorityP273critical10CVSS 3.1

AVNACLPRNUINSCCHIHAH

EPSS

4.71%

90.8th percentile

SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and even outside the network segment dedicated for the internal cluster communication. As result, an unauthenticated attacker can invoke certain functions that would otherwise be restricted to system administrators only, including access to system administration functions or shutting down the system completely.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
sap	netweaver_application_server_java	—	—
sap	netweaver_application_server_java	—	—
sap	netweaver_application_server_java	—	—
sap	netweaver_application_server_java	—	—
sap	netweaver_application_server_java	—	—
sap	netweaver_application_server_java	—	—
sap_se	sap_netweaver_as_java	< 7.11	7.11
sap_se	sap_netweaver_as_java	< 7.20	7.20
sap_se	sap_netweaver_as_java	< 7.30	7.30
sap_se	sap_netweaver_as_java	< 7.31	7.31
sap_se	sap_netweaver_as_java	< 7.40	7.40
sap_se	sap_netweaver_as_java	< 7.50	7.50

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvdv3.010.0CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvdv2.09.0CRITICALAV:N/AC:L/Au:N/C:P/I:P/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.