Patch days / December 2020

SAP Security Patch Day — December 2020

Tuesday, 8 December 2020

Vulnerabilities: 12
Critical: 3
High: 3
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 3

Critical 10.0
CVE-2020-26829 SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missin…
EPSS 4.8%
Critical 9.6
CVE-2020-26831 SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generati…
EPSS 1.1%
Critical 9.1
CVE-2020-26838 SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenti…
EPSS 2.2%

All vulnerabilities 12

Critical3 Show

High3 Show

Medium5 Show

Low1 Show

Low 3.4
CVE-2020-26836 Scanner template SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attack…
EPSS 2.2%