Read the docs
TI-2020-16296 Aliases CVE-2020-26832GHSA-898v-h686-8h79

Missing authorization in SAP NetWeaver AS ABAP

Priority LOW 38CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable.

Why it matters now

EPSS 0.02189 82nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed SAP NetWeaver AS ABAP (SAP Landscape Transformation) (SAP SE): 2011_1_620, 2011_1_640, 2011_1_700 +5SAP S4 HANA (SAP Landscape Transformation) (SAP SE): 101, 102, 103 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP NetWeaver AS ABAP (SAP Landscape Transformation)before 2011_1_620; before 2011_1_640; before 2011_1_700; before 2011_1_710; before 2011_1_730; before 2011_1_731; before 2011_1_752; before 20202011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020Patch availableCNA
SAPSAP S4 HANA (SAP Landscape Transformation)before 101; before 102; before 103; before 104; before 105101, 102, 103, 104, 105Patch availableCNA
  • SAP NetWeaver AS ABAP (SAP Landscape Transformation) VendorSAP Affected before 2011_1_620; before 2011_1_640; before 2011_1_700; before 2011_1_710; before 2011_1_730; before 2011_1_731; before 2011_1_752; before 2020 Fixed in 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 Patch available CNA
  • SAP S4 HANA (SAP Landscape Transformation) VendorSAP Affected before 101; before 102; before 103; before 104; before 105 Fixed in 101, 102, 103, 104, 105 Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_620:*:*:*:*:*:*:*2011_1_620VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_640:*:*:*:*:*:*:*2011_1_640VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_700:*:*:*:*:*:*:*2011_1_700VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_710:*:*:*:*:*:*:*2011_1_710VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_730:*:*:*:*:*:*:*2011_1_730VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_731:*:*:*:*:*:*:*2011_1_731VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_752:*:*:*:*:*:*:*2011_1_752VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:2020:*:*:*:*:*:*:*2020VulnerableSAP
cpe:2.3:a:sap:s\/4_hana:101:*:*:*:*:*:*:*101VulnerableSAP
cpe:2.3:a:sap:s\/4_hana:102:*:*:*:*:*:*:*102VulnerableSAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_620:*:*:*:*:*:*:* Versions 2011_1_620 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_640:*:*:*:*:*:*:* Versions 2011_1_640 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_700:*:*:*:*:*:*:* Versions 2011_1_700 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_710:*:*:*:*:*:*:* Versions 2011_1_710 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_730:*:*:*:*:*:*:* Versions 2011_1_730 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_731:*:*:*:*:*:*:* Versions 2011_1_731 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_752:*:*:*:*:*:*:* Versions 2011_1_752 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4_hana:101:*:*:*:*:*:*:* Versions 101 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4_hana:102:*:*:*:*:*:*:* Versions 102 Vulnerable ·SAP
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:s\/4_hana:103:*:*:*:*:*:*:*103VulnerableSAP
cpe:2.3:a:sap:s\/4_hana:104:*:*:*:*:*:*:*104VulnerableSAP
cpe:2.3:a:sap:s\/4_hana:105:*:*:*:*:*:*:*105VulnerableSAP
  • cpe:2.3:a:sap:s\/4_hana:103:*:*:*:*:*:*:* Versions 103 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4_hana:104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4_hana:105:*:*:*:*:*:*:* Versions 105 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP NetWeaver AS ABAP (SAP Landscape Transformation) (SAP SE) Fixed in 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020
  • Fix · CNA SAP S4 HANA (SAP Landscape Transformation) (SAP SE) Fixed in 101, 102, 103, 104, 105

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26832
  2. 2026-10-03 Alias added: GHSA-898v-h686-8h79

References

Exploit 2

Advisory 1

Other 1

  • TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
  • TI-2023-12229 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
  • TI-2023-12228 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
  • TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
  • TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences