# CVE-2020-6207: SAP Solution Manager - Authentication Bypass

> Live exploitation tracking for CVE-2020-6207 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2020-6207

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** SAP Solution Manager (user Experience Monitoring)
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** enterprise_software

## Description

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.

## CrowdSec analysis

[CVE-2020-6207](https://euvd.enisa.europa.eu/vulnerability/CVE-2020-6207) is a critical vulnerability in SAP Solution Manager, where missing authentication checks in a specific administrative service can allow remote attackers to compromise all connected agents.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of May 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2020-6207 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
In addition, according to the CrowdSec network, attack volume against CVE-2020-6207 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed exploitation attempts are associated with requests to the `/eemadminservice/eemadmin` endpoint.

## Timeline

- 2020-03-10: CVE Published. CVE-2020-6207 is published to NVD.
- 2021-11-03: CISA KEV. CVE-2020-6207 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-05-03: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-05-23: Rule Released. CrowdSec releases a rule to detect CVE-2020-6207 exploitation attempts against the CrowdSec Network.
- 2025-05-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2020-6207 for the first time.

## References

- https://launchpad.support.sap.com/#/notes/2890213
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6207.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2020-6207) follows observed exploitation activity for CVE-2020-6207. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.