CVE-2020-6304: SAP NetWeaver Internet Communication Manager (kernel)

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.

Affected products

• SAP NetWeaver Internet Communication Manager (kernel): version 7.21 only; version 7.22 only; version 7.49 only; version 7.53 only
• SAP NetWeaver Internet Communication Manager (krnl32nuc): version 7.21 only; version 7.21ext only; version 7.22 only; version 7.22ext only
• SAP NetWeaver Internet Communication Manager (krnl32uc): version 7.21 only; version 7.21ext only; version 7.22 only; version 7.22ext only
• SAP NetWeaver Internet Communication Manager (krnl64nuc): version 7.21 only; version 7.21ext only; version 7.22 only; version 7.22ext only; version 7.49 only
• SAP NetWeaver Internet Communication Manager (krnl64uc): version 7.21 only; version 7.21ext only; version 7.22 only; version 7.22ext only; version 7.49 only

Published 2020-01-14. Last modified 2026-06-17.