CVE-2020-6197: SAP Enable Now

Low severity, CVSS 3.3. EPSS: 0.6% chance of exploitation in the next 30 days.

SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local access, for instance, to still download the portables.

Affected products

• SAP Enable Now: before 1908 (fixed in 1908)

Published 2020-03-10. Last modified 2026-06-17.