CVE-2020-26826: 
SAP NetWeaver Application Server Java vulnerability analysis and mitigation

Process Integration Monitoring of SAP NetWeaver AS JAVA, versions 7.31, 7.40, and 7.50, contains a vulnerability that allows an attacker to upload any file (including script files) without proper file format validation, leading to Unrestricted File Upload. This vulnerability was assigned CVE-2020-26826 and was disclosed in December 2020 (NVD, CVE).

The vulnerability is classified as an Unrestricted File Upload issue (CWE-434). It has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability affects the file upload functionality in Process Integration Monitoring component, where the application fails to properly validate file formats before upload (NVD).

The vulnerability could allow an attacker to upload malicious files, including script files, which could potentially lead to high availability impact on the affected system. The CVSS scoring indicates no direct impact on confidentiality or integrity, but a high impact on system availability (NVD).

The vulnerability requires network access and low privileged access to exploit. No user interaction is needed for exploitation. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit under the right conditions (NVD).

SAP has released security patches to address this vulnerability. Users should refer to SAP Security Note 2974330 for detailed mitigation instructions (SAP Note).