CVE-2020-6287

Confirmed PUBLISHED

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an...

SAP SE · SAP NetWeaver AS JAVA (LM Configuration Wizard)

Exploited in the wild Active exploitation observed PoC available Virtual patch available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

Unique Attacker IPs

CISA KEV

In CISA KEV

Virtual Patch

Yes 3 targets

CVSS / EPSS

10.0 Critical EPSS 94.7%

At a Glance

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

nuclei_scanner cisa java

CVE Published: Jul 14, 2020
Exploitation Reported: Nov 03, 2021
CVSS: 10.0 Critical
EPSS: 94.7%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
SAP SE	SAP NetWeaver AS JAVA (LM Configuration Wizard)	< 7.30	Affected
SAP SE	SAP NetWeaver AS JAVA (LM Configuration Wizard)	< 7.31	Affected
SAP SE	SAP NetWeaver AS JAVA (LM Configuration Wizard)	< 7.40	Affected
SAP SE	SAP NetWeaver AS JAVA (LM Configuration Wizard)	< 7.50	Affected

CVE References

20210405 Onapsis Security Advisory 2021-0003: [CVE-2020-6287] - [SAP RECON] SAP JAVA: Unauthenticated execution of configuration tasks seclists.org · Mailing List http://seclists.org/fulldisclosure/2021/Apr/6
wiki.scn.sap.com/wiki/pages/viewpage.action wiki.scn.sap.com · CVE Record https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
launchpad.support.sap.com launchpad.support.sap.com · CVE Record https://launchpad.support.sap.com/#/notes/2934135
onapsis.com/recon-sap-cyber-security-vulnerability onapsis.com · CVE Record https://www.onapsis.com/recon-sap-cyber-security-vulnerability
packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Exe... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Ta...

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC
The Shadowserver	2026-06-06 00:00 UTC
KEVIntel	2026-06-12 00:32 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 1
Distinct User-Agents: 22

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6287.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v3.0 10.0 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Active exploitation observed

Recorded 2026-06-12 00:32:46 UTC · KEVIntel sensor

Proof of concept available

Recorded 2020-07-20 18:45:53 UTC · GitHub

Weaknesses (CWE)

CWE-306

Missing Authentication for Critical Function

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6287.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

murataydemir/CVE-2020-6287

github · Created 2020-08-13 09:12:37 UTC · 13 stars

[CVE-2020-6287] SAP NetWeaver AS JAVA (LM Configuration Wizard) Authentication Bypass (Create Simple & Administrator Java User)

Onapsis/CVE-2020-6287_RECON-scanner

github · Created 2020-07-21 01:22:45 UTC · 28 stars

duc-nt/CVE-2020-6287-exploit

github · Created 2020-07-20 18:45:53 UTC · 96 stars

PoC for CVE-2020-6287 The PoC in python for add user only, no administrator permission set. Inspired by @zeroSteiner from metasploit. Original Metasploit PR module: https://github.com/rapid7/metasploit-framework/pull/13852/commits/d1e2c75b3eafa7f62a6aba9fbe6220c8da97baa8 This PoC only create user with unauthentication permission and no more administrator permission set. This project is created only for educational purposes and cannot be used for law violation or personal gain. The author of this project is not responsible for any possible harm caused by the materials of this project. Original finding: CVE-2020-6287: Pablo Artuso CVE-2020-6286: Yvan 'iggy' G. Usage: python sap-CVE-2020-6287-add-user.py <HTTP(s)://IP:Port

SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

22 Jun 2026 14:21 UTC 27 days ago

22 Jun 2026 14:21 UTC · 27 days ago

Virtual patch available

Compensating WAF rule available to block exploitation
12 Jun 2026 00:32 UTC about 1 month ago

12 Jun 2026 00:32 UTC · about 1 month ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
12 Jun 2026 00:32 UTC about 1 month ago

12 Jun 2026 00:32 UTC · about 1 month ago

Indicators of compromise added (20)

Indicators of compromise recorded
6 Jun 2026 00:00 UTC about 1 month ago

6 Jun 2026 00:00 UTC · about 1 month ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
20 Jul 2020 18:45 UTC almost 6 years ago

20 Jul 2020 18:45 UTC · almost 6 years ago

Public PoC available

Public proof-of-concept code published
14 Jul 2020 12:30 UTC about 6 years ago

14 Jul 2020 12:30 UTC · about 6 years ago

CVE published

Vulnerability disclosed publicly
8 Jan 2020 00:00 UTC over 6 years ago

8 Jan 2020 00:00 UTC · over 6 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2020-6287

{
  "cve_id": "CVE-2020-6287",
  "title": "SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40,...",
  "affected_vendor": "SAP SE",
  "affected_product": "SAP NetWeaver AS JAVA (LM Configuration Wizard)",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 10.0,
  "epss_score": 0.94719,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2020-6287

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 39 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

Supported Platforms

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API