Read the docs
TI-2020-16275 Aliases CVE-2020-26808GHSA-49f8-w2xp-h8gq

SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730…

Priority LOW 37Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.

Why it matters now

EPSS 0.0305 87th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed SAP AS ABAP(DMIS) (SAP SE): 2011_1_620, 2011_1_640, 2011_1_700 +5SAP S4 HANA(DMIS) (SAP SE): 101, 102, 103 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP AS ABAP(DMIS)before 2011_1_620; before 2011_1_640; before 2011_1_700; before 2011_1_710; before 2011_1_730; before 2011_1_731; before 2011_1_752; before 20202011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020Patch availableCNA
SAPSAP S4 HANA(DMIS)before 101; before 102; before 103; before 104; before 105101, 102, 103, 104, 105Patch availableCNA
  • SAP AS ABAP(DMIS) VendorSAP Affected before 2011_1_620; before 2011_1_640; before 2011_1_700; before 2011_1_710; before 2011_1_730; before 2011_1_731; before 2011_1_752; before 2020 Fixed in 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 Patch available CNA
  • SAP S4 HANA(DMIS) VendorSAP Affected before 101; before 102; before 103; before 104; before 105 Fixed in 101, 102, 103, 104, 105 Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_620:*:*:*:*:*:*:*2011_1_620VulnerableSAP
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_640:*:*:*:*:*:*:*2011_1_640VulnerableSAP
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_700:*:*:*:*:*:*:*2011_1_700VulnerableSAP
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_710:*:*:*:*:*:*:*2011_1_710VulnerableSAP
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_730:*:*:*:*:*:*:*2011_1_730VulnerableSAP
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_731:*:*:*:*:*:*:*2011_1_731VulnerableSAP
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_752:*:*:*:*:*:*:*2011_1_752VulnerableSAP
cpe:2.3:a:sap:sap_as_abap\(dmis\):2020:*:*:*:*:*:*:*2020VulnerableSAP
cpe:2.3:a:sap:sap_s4_hana\(dmis\):101:*:*:*:*:*:*:*101VulnerableSAP
cpe:2.3:a:sap:sap_s4_hana\(dmis\):102:*:*:*:*:*:*:*102VulnerableSAP
  • cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_620:*:*:*:*:*:*:* Versions 2011_1_620 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_640:*:*:*:*:*:*:* Versions 2011_1_640 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_700:*:*:*:*:*:*:* Versions 2011_1_700 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_710:*:*:*:*:*:*:* Versions 2011_1_710 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_730:*:*:*:*:*:*:* Versions 2011_1_730 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_731:*:*:*:*:*:*:* Versions 2011_1_731 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_752:*:*:*:*:*:*:* Versions 2011_1_752 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_as_abap\(dmis\):2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_s4_hana\(dmis\):101:*:*:*:*:*:*:* Versions 101 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_s4_hana\(dmis\):102:*:*:*:*:*:*:* Versions 102 Vulnerable ·SAP
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:sap_s4_hana\(dmis\):103:*:*:*:*:*:*:*103VulnerableSAP
cpe:2.3:a:sap:sap_s4_hana\(dmis\):104:*:*:*:*:*:*:*104VulnerableSAP
cpe:2.3:a:sap:sap_s4_hana\(dmis\):105:*:*:*:*:*:*:*105VulnerableSAP
  • cpe:2.3:a:sap:sap_s4_hana\(dmis\):103:*:*:*:*:*:*:* Versions 103 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_s4_hana\(dmis\):104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_s4_hana\(dmis\):105:*:*:*:*:*:*:* Versions 105 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP AS ABAP(DMIS) (SAP SE) Fixed in 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020
  • Fix · CNA SAP S4 HANA(DMIS) (SAP SE) Fixed in 101, 102, 103, 104, 105

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26808
  2. 2026-10-03 Alias added: GHSA-49f8-w2xp-h8gq

References

Exploit 2

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences