Security readout for executives and security teams
Plain-English summary
CVE-2020-26822 is a critical unauthenticated weakness in SAP Solution Manager Java stack involving missing authorization checks in the Outside Discovery Configuration Service. A reachable vulnerable system could be compromised in ways that affect service integrity and availability. The source bundle does not show confidentiality impact or confirmed active exploitation.
Executive priority
Treat this as urgent for any SAP Solution Manager Java stack environment. Confirm applicability, apply SAP guidance, and reduce service exposure immediately, especially where the system supports production monitoring or operations.
Technical view
The CVSS 3.0 score is 10.0 with network attack vector, low complexity, no privileges, no user interaction, and changed scope. The described flaw is missing authorization checks in SAP Solution Manager Java stack Outside Discovery Configuration Service, enabling unauthenticated system compromise with high integrity and availability impact.
Likely exposure
Exposure is most likely where SAP Solution Manager Java stack is deployed and the affected service is reachable over the network. The bundle names SAP Solution Manager Java stack 7.20, while its affected list states versions below 7.20; validate against SAP Note 2985866.
Exploitation context
The provided sources do not cite active exploitation, and the CVE is not marked as CISA KEV. Risk remains urgent because the flaw is unauthenticated, network reachable, low complexity, and rated CVSS 10.0.
Researcher notes
The bundle provides strong severity and vector data but limited remediation detail. It also contains a version ambiguity between the title and affected-version field. Use SAP Note 2985866 as the authoritative source for exact affected releases and fixes.
Mitigation direction
- Review SAP Note 2985866 and SAP’s linked advisory for official correction guidance.
- Apply the vendor-provided fix or mitigation once confirmed for your installed version.
- Restrict network access to SAP Solution Manager administrative and discovery services.
- Prioritize systems exposed to untrusted networks or shared enterprise segments.
- Monitor for unexpected configuration changes or service availability degradation.
Validation and detection
- Inventory SAP Solution Manager Java stack deployments and record exact versions.
- Confirm whether SAP Note 2985866 is applicable and implemented.
- Check whether the Outside Discovery Configuration Service is reachable from untrusted networks.
- Review access controls around Solution Manager administrative services.
- Look for unusual unauthenticated requests, configuration changes, or availability events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-26822 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H3.95.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
10CriticalVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571CVE reference · x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2985866CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.