LiveActive security incident?Get immediate response
CVE Record

CVE-2020-26814: SAP Process Integration (PGP Module - Business-to-Business Add On), version - 1.0, allows an attacker to re...

SAP Process Integration (PGP Module - Business-to-Business Add On), version - 1.0, allows an attacker to read PGP Keys under certain conditions in the PGP Module of Business-to-Business Add-On, these keys can then be used to read messages processed by the module leading to Information Disclosure.

MediumCVSS 4.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw could let a highly privileged attacker read PGP keys used by SAP Process Integration’s B2B PGP module. Those keys may allow confidential business messages processed by the module to be read. The main business concern is loss of message confidentiality, not system takeover or outage.

Executive priority

Treat this as a confidentiality risk for sensitive B2B message traffic. Prioritize review if SAP PI handles regulated, financial, supplier, or customer data. Urgency is moderate because exploitation requires high privileges and no active exploitation is cited.

Technical view

CVE-2020-26814 affects SAP Process Integration PGP Module - Business-to-Business Add On. The CVSS vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning network-reachable, low complexity, high privileges required, and confidentiality-only impact. The source says PGP keys may be readable under certain conditions.

Likely exposure

Exposure is limited to organizations using SAP Process Integration with the Business-to-Business Add On PGP module. Risk is highest where the module processes sensitive encrypted business messages and privileged SAP access is broadly assigned or weakly monitored.

Exploitation context

The source bundle does not indicate active exploitation, and KEV is false. The CVSS vector requires high privileges, so practical exploitation likely depends on a compromised or misused privileged SAP account. The exact triggering conditions are not described in the provided sources.

Researcher notes

The affected-version data in the bundle is inconsistent: the description names version 1.0, while affected metadata lists versions below 1.0. Validate against SAP Note 2952084 before scoping. No CWE, exploit details, or complete mitigation text is included in the provided bundle.

Mitigation direction

  • Review SAP Note 2952084 for vendor-approved remediation guidance.
  • Apply the relevant SAP security update or configuration guidance if available.
  • Restrict privileged access to the B2B PGP module and key material.
  • Rotate exposed PGP keys if unauthorized access is suspected.
  • Monitor privileged SAP activity involving PGP key storage or retrieval.

Validation and detection

  • Inventory SAP PI systems using the B2B Add On PGP module.
  • Confirm installed component versions against SAP Note 2952084.
  • Review whether privileged users can read stored PGP keys.
  • Check logs for unusual access to PGP key material.
  • Identify sensitive message flows processed by the affected module.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-26814 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.9 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.9CVSS 3.0MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N1.23.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

4.9Medium
CVSS 3.0 vector shape for CVE-2020-26814Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
SAP SESAP Process Integration (PGP - Module Business-to-Business Add On)< 1.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.