CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- SAP Solution Manager Missing Authentication for Critical Function Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
Affected products
sap: solution manager
References10
- launchpad.support.sap.com/#/notes/2890213 Permissions RequiredVendor Advisory
- wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 Broken LinkVendor Advisory
- launchpad.support.sap.com/#/notes/2890213 Permissions RequiredVendor Advisory
- wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 Broken LinkVendor Advisory
- packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-R… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthentica… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-R… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthentica… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/163168/SAP-Solution-Manager-7.20-… Third Party Advisory
- seclists.org/fulldisclosure/2021/Apr/4 Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 98% percentile: 100 · as of 11 November 2026
- CWE
- CWE-306
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.