Security readout for executives and security teams
Plain-English summary
This issue is about unsafe default file permissions in the SAP ERP Client for E-Bilanz installation folder. A local user could modify files there, potentially affecting trust in the client installation or disrupting its operation. It is not described as a remote compromise or data theft issue.
Executive priority
Handle as a targeted endpoint hardening issue, not an emergency internet-facing incident. Prioritize organizations using SAP E-Bilanz workflows or shared workstations, because unauthorized local file modification can undermine business process integrity.
Technical view
CVE-2020-26807 affects SAP ERP Client for E-Bilanz. The installer sets incorrect default filesystem permissions on the installation directory, allowing local modification of files. CVSS 3.0 is 4.4 with local access, low complexity, low privileges, no user interaction, and low integrity and availability impact.
Likely exposure
Exposure is limited to systems with SAP ERP Client for E-Bilanz installed, especially where non-administrative local users can access the installation directory. The bundle has inconsistent affected-version metadata, so confirm exact applicability against SAP Note 2971112.
Exploitation context
The source bundle does not show CISA KEV listing or any cited evidence of active exploitation. Exploitation requires local access with low privileges; the documented impact is unauthorized file modification, not remote code execution or confidentiality loss.
Researcher notes
The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. Scope is unchanged and impact is limited to integrity and availability. The provided affected-version field conflicts with the title, so vendor-note confirmation is important before scoping.
Mitigation direction
- Review SAP Note 2971112 for the vendor-approved correction and affected-version details.
- Inventory hosts running SAP ERP Client for E-Bilanz.
- Restrict installation folder write/modify permissions according to SAP guidance.
- Update, repair, or reinstall the client if SAP guidance requires it.
- Limit local interactive access on affected workstations where possible.
Validation and detection
- Confirm whether SAP ERP Client for E-Bilanz is installed on endpoint images.
- Check the installed version against SAP Note 2971112.
- Review installation directory permissions for non-admin write or modify access.
- Verify remediation by rechecking permissions after update or repair.
- Monitor affected folders for unexpected file changes until remediated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-26807 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L1.82.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
4.4MediumVector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571CVE reference · x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2971112CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.