CVE-2020-26816: sap se sap netweaver as java (key storage service)
Vulnerability summary
CVE-2020-26816 is a medium (CVSS 5.4) vulnerability in sap se sap netweaver as java (key storage service). EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.9% of scored vulnerabilities.
Timeline
- 09-12-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key Storage service stored in the database in the DER encoded format and is not encrypted. This enables an attacker who has administrator access to the SAP NetWeaver AS Java to decode the keys because of missing encryption and get some application data and client credentials of adjacent systems. This highly impacts Confidentiality as information disclosed could contain client credentials of adjacent systems.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST5.4MediumCVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
0.00 pp
From 0.17% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap1 product
- netweaver_application_server_java7.10 | 7.11 | 7.20 | 7.30 | 7.31 | 7.40 | 7.50
Sap se1 product
- sap netweaver as java (key storage service)< 7.10 | < 7.11 | < 7.20 | < 7.30 | < 7.31 | < 7.40 | < 7.50
2 vendors · 2 products