CVE-2020-26832

SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable.

• CWE-862

• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2993132Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079Vendor Advisory
• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2993132Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079Vendor Advisory

Published

Dec 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26826Process Integration Monitoring of SAP NetWeaver AS JAVA, ver…6.5
• CVE-2020-26828SAP Disclosure Management, version - 10.1, provides capabili…6.4
• CVE-2020-26829SAP NetWeaver AS JAVA (P2P Cluster Communication), versions …10
• CVE-2020-2683Vulnerability in the Oracle FLEXCUBE Universal Banking produ…5.4
• CVE-2020-26830SAP Solution Manager 7.2 (User Experience Monitoring), versi…8.1
• CVE-2020-26831SAP BusinessObjects BI Platform (Crystal Report), versions -…9.6
• CVE-2020-26834SAP HANA Database, version - 2.0, does not correctly validat…5.4
• CVE-2020-26835SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 7…6.1
• CVE-2020-26836SAP Solution Manager (Trace Analysis), version - 720, allows…6.1
• CVE-2020-26837SAP Solution Manager 7.2 (User Experience Monitoring), versi…9.1
• CVE-2020-26838SAP Business Warehouse, versions - 700, 701, 702, 731, 740, …9.1
• CVE-2020-26839Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…