{"cve":"CVE-2020-26816","nvd":{"published":"2020-12-09T17:15:30.713","modified":"2026-06-17T03:08:23.213","status":"Modified","description":"SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key Storage service stored in the database in the DER encoded format and is not encrypted. This enables an attacker who has administrator access to the SAP NetWeaver AS Java to decode the keys because of missing encryption and get some application data and client credentials of adjacent systems. This highly impacts Confidentiality as information disclosed could contain client credentials of adjacent systems.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.5},"cwes":["CWE-312"],"references":["https://launchpad.support.sap.com/#/notes/2971163","https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079","https://launchpad.support.sap.com/#/notes/2971163","https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079"],"products":["sap:netweaver_application_server_java"],"source":"nvd","synced_at":"2026-10-19T21:12:09.559580076+00:00"},"epss":{"cve":"CVE-2020-26816","score":0.00169,"percentile":0.06284,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}