SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730…
Priority MEDIUM 41Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.
Why it matters now
EPSS 0.01327 71st percentileScored 2026-11-07
Fix Fixed SAP NetWeaver (ABAP Server) and ABAP Platform (SAP SE): 700, 701, 702 +9
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP NetWeaver (ABAP Server) and ABAP Platform | before 700; before 701; before 702; before 710; before 711; before 730; before 731; before 740; before 750; before 751; before 753; before 755 | 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755 | Patch available | CNA |
- SAP NetWeaver (ABAP Server) and ABAP Platform VendorSAP Affected before 700; before 701; before 702; before 710; before 711; before 730; before 731; before 740; before 750; before 751; before 753; before 755 Fixed in 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755 Patch available CNA
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:abap_platform:7.31:*:*:*:*:*:*:* | 7.31 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform:700:*:*:*:*:*:*:* | 700 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform:701:*:*:*:*:*:*:* | 701 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform:702:*:*:*:*:*:*:* | 702 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform:710:*:*:*:*:*:*:* | 710 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform:711:*:*:*:*:*:*:* | 711 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform:740:*:*:*:*:*:*:* | 740 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform:753:*:*:*:*:*:*:* | 753 | Vulnerable | SAP |
- cpe:2.3:a:sap:abap_platform:7.31:*:*:*:*:*:*:* Versions 7.31 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform:710:*:*:*:*:*:*:* Versions 710 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform:711:*:*:*:*:*:*:* Versions 711 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:abap_platform:755:*:*:*:*:*:*:* | 755 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* | 700 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* | 701 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* | 702 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:* | 710 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:* | 711 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* | 731 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* | 740 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* | 753 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* | 755 | Vulnerable | SAP |
- cpe:2.3:a:sap:abap_platform:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:* Versions 710 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:* Versions 711 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
Remediation
- Fix · CNA SAP NetWeaver (ABAP Server) and ABAP Platform (SAP SE) Fixed in 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755
Timeline
- 2026-10-02 Threatist record created from CVE-2020-6296
- 2026-10-03 Alias added: GHSA-x7q6-8p3j-gwjm
References
More SAP Abap Platform vulnerabilities
- TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
- TI-2024-14732 Code Injection vulnerability in SAP ABA (Application Basis) CVSS 3.1CRITICAL 9.1
- TI-2020-05170 Code injection in SAP NetWeaver and ABAP Platform CVSS 3.1HIGH 7.2
- TI-2023-10915 SQL Injection vulnerability in SAP ABAP Platform CVSS 3.1MEDIUM 6.8
- TI-2020-05039 Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS… CVSS 3.1MEDIUM 5.8
- TI-2024-18506 Missing Authorization check in SAP ABAP Platform CVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-6296 · CVE Program
- CVE-2020-6296 · NVD
- FIRST EPSS
- GHSA-x7q6-8p3j-gwjm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences