CVE-2020-6364: SAP Introscope Enterprise Manager

Critical severity, CVSS 10.0. EPSS: 6.4% chance of exploitation in the next 30 days.

SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that OS commands can be executed and potentially gain control over the host running the CA Introscope Enterprise Manager,leading to Code Injection. With this, the attacker is able to read and modify all system files and also impact system availability.

Affected products

• SAP Introscope Enterprise Manager: version 9.7 only; version 10.1 only; version 10.5 only; version 10.7 only

Published 2020-10-15. Last modified 2026-06-17.