CVE-2020-6207

What is SAP Solution Manager?

SAP Solution Manager (SolMan) is the centralized administration hub for an organization's entire SAP landscape — it monitors, configures, and pushes changes to every connected SAP system through a network of "SMD Agents" deployed on each managed host. Because SolMan has trusted management access into every system it oversees, compromising it is one of the most efficient ways to pivot into an organization's full SAP estate at once, rather than attacking each system individually.

Overview

CVE-2020-6207 is a missing-authentication vulnerability (CWE-306) in SolMan's End-User Experience Monitoring (EEM) component. A servlet used to distribute monitoring scripts to SMD Agents across the landscape does not enforce an authentication check, allowing an unauthenticated network attacker to submit and execute arbitrary scripts on every SMD Agent SolMan manages — effectively a single unauthenticated request that compromises an entire SAP landscape's worth of connected systems (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical).

Affected Versions

Technical Details

SolMan's EEM functionality is designed to push diagnostic and monitoring scripts out to SMD Agents installed on managed systems throughout the landscape. The servlet handling this distribution fails to verify that the requester is an authenticated SolMan administrator before accepting and forwarding a script for execution. Because SMD Agents implicitly trust instructions coming from their managing Solution Manager, an attacker who reaches the vulnerable servlet can push malicious code to every agent in the environment in one action — turning a single missing authentication check into landscape-wide remote code execution.

Discovery

CISA and industry researchers, including SAP-focused security firms such as Onapsis, have documented this vulnerability class as part of a broader pattern of scanning and exploitation attempts against internet-facing SAP infrastructure that intensified through 2020–2021.

Exploitation Context

CISA and the FBI issued public warnings about active scanning and exploitation attempts against unpatched SAP applications, including Solution Manager, as attackers sought footholds into high-value enterprise resource planning environments. CISA added this CVE to KEV in November 2021 based on confirmed exploitation.

Remediation

1. Apply SAP's March 2020 Security Patch Day fix for Solution Manager 7.2 immediately if not already done — this vulnerability has had a patch available for years and remaining unpatched is a high-confidence indicator of compromise risk.
2. Restrict network access to SolMan's EEM servlet to only the SMD Agents and administrators that need it; it should never be directly reachable from the internet.
3. Audit SMD Agent logs across the landscape for unexpected scripts pushed from SolMan, especially any that don't correspond to known administrator activity.
4. Treat SolMan as Tier-0 infrastructure in your SAP security program — equivalent to a domain controller in a Windows environment — given its trusted reach into every system it manages.