CVE-2020-26818

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-10 · updated 2026-06-17
Weakness: CWE-862

Description

SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, which reveals sensitive system information that would otherwise be restricted to highly privileged users because of missing authorization, resulting in Information Disclosure.

Affected products

SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: 731, 740, 750, 751, 752, 753 (+3)

References

https://launchpad.support.sap.com/#/notes/2971954
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
https://launchpad.support.sap.com/#/notes/2971954
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571

Get alerted when CVE-2020-26818 or the next vulnerability affects your stack