OS command injection in SAP Solution Manager and SAP Focused Run
Priority MEDIUM 52CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that OS commands can be executed and potentially gain control over the host running the CA Introscope Enterprise Manager,leading to Code Injection. With this, the attacker is able to read and modify all system files and also impact system availability.
Why it matters now
EPSS 0.06408 93rd percentileScored 2026-11-07
Fix Fixed SAP Solution Manager (CA Introscope Enterprise Manager) and SAP Focused Run (CA Introscope Enterprise Manager) (SAP SE): 10.1, 10.5, 10.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Solution Manager (CA Introscope Enterprise Manager) and SAP Focused Run (CA Introscope Enterprise Manager) | < WILY_INTRO_ENTERPRISE 9.7; before 10.1; before 10.5; before 10.7 | 10.1, 10.5, 10.7 | Patch available | CNA |
- SAP Solution Manager (CA Introscope Enterprise Manager) and SAP Focused Run (CA Introscope Enterprise Manager) VendorSAP Affected < WILY_INTRO_ENTERPRISE 9.7; before 10.1; before 10.5; before 10.7 Fixed in 10.1, 10.5, 10.7 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:introscope_enterprise_manager:9.7:*:*:*:*:*:*:* | 9.7 | Vulnerable | SAP |
| cpe:2.3:a:sap:introscope_enterprise_manager:10.1:*:*:*:*:*:*:* | 10.1 | Vulnerable | SAP |
| cpe:2.3:a:sap:introscope_enterprise_manager:10.5:*:*:*:*:*:*:* | 10.5 | Vulnerable | SAP |
| cpe:2.3:a:sap:introscope_enterprise_manager:10.7:*:*:*:*:*:*:* | 10.7 | Vulnerable | SAP |
- cpe:2.3:a:sap:introscope_enterprise_manager:9.7:*:*:*:*:*:*:* Versions 9.7 Vulnerable ·SAP
- cpe:2.3:a:sap:introscope_enterprise_manager:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·SAP
- cpe:2.3:a:sap:introscope_enterprise_manager:10.5:*:*:*:*:*:*:* Versions 10.5 Vulnerable ·SAP
- cpe:2.3:a:sap:introscope_enterprise_manager:10.7:*:*:*:*:*:*:* Versions 10.7 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Solution Manager (CA Introscope Enterprise Manager) and SAP Focused Run (CA Introscope Enterprise Manager) (SAP SE) Fixed in 10.1, 10.5, 10.7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-6364
- 2026-10-03 Alias added: GHSA-w6w2-xxmc-3cmj
References
Advisory 4
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196
- https://launchpad.support.sap.com/#/notes/2969828
- 20210614 Onapsis Security Advisory 2021-0008: OS Command Injection in CA Introscope Enterprise Manager
- http://packetstormsecurity.com/files/163153/SAP-Wily-Introscope-Enterprise-OS-Command-Injection.html
More SAP Introscope Enterprise Manager vulnerabilities
- TI-2026-00308 Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation) CVSS 3.1CRITICAL 9.6
Sources
- CVE-2020-6364 · CVE Program
- CVE-2020-6364 · NVD
- FIRST EPSS
- GHSA-w6w2-xxmc-3cmj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences