Read the docs
TI-2020-16301 Aliases CVE-2020-26838GHSA-j3jc-48fv-7w6q

OS command injection in SAP Business Warehouse

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with (high) developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It is possible to craft a request which will result in the execution of Operating System commands leading to Code Injection vulnerability which could completely compromise the confidentiality, integrity and availability of the server and any data or other applications running on it.

Why it matters now

EPSS 0.02247 82nd percentileScored 2026-11-07
Fix Fixed SAP Business Warehouse (SAP SE): 700, 701, 702 +9SAP BW4HANA (SAP SE): 100, 200

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Business Warehousebefore 700; before 701; before 702; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755; before 782700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782Patch availableCNA
SAPSAP BW4HANAbefore 100; before 200100, 200Patch availableCNA
  • SAP Business Warehouse VendorSAP Affected before 700; before 701; before 702; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755; before 782 Fixed in 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782 Patch available CNA
  • SAP BW4HANA VendorSAP Affected before 100; before 200 Fixed in 100, 200 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:*700VulnerableSAP
cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:*701VulnerableSAP
cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:*702VulnerableSAP
cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*731VulnerableSAP
cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*740VulnerableSAP
cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*750VulnerableSAP
cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:*751VulnerableSAP
cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:*752VulnerableSAP
cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:*753VulnerableSAP
cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:*754VulnerableSAP
  • cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:*755VulnerableSAP
cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:*782VulnerableSAP
cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:*100VulnerableSAP
cpe:2.3:a:sap:bw\/4hana:200:*:*:*:*:*:*:*200VulnerableSAP
  • cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:* Versions 782 Vulnerable ·SAP
  • cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP
  • cpe:2.3:a:sap:bw\/4hana:200:*:*:*:*:*:*:* Versions 200 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Business Warehouse (SAP SE) Fixed in 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782
  • Fix · CNA SAP BW4HANA (SAP SE) Fixed in 100, 200

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26838
  2. 2026-10-03 Alias added: GHSA-j3jc-48fv-7w6q

References

Advisory 1

Other 1

  • TI-2021-04563 SQL injection in SAP Business Warehouse CVSS 3.1CRITICAL 9.9
  • TI-2021-04564 Code injection in SAP Business Warehouse CVSS 3.1HIGH 8.8
  • TI-2021-04566 Missing authorization in SAP Business Warehouse CVSS 3.1MEDIUM 6.5
  • TI-2023-16859 Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA CVSS 3.1MEDIUM 6.5
  • TI-2024-26524 Cross-site scripting in SAP Business Warehouse - Business Planning and Simulation CVSS 3.1MEDIUM 6.1
  • TI-2024-26525 Cross-site scripting in SAP Business Warehouse - Business Planning and Simulation CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences