CVE-2026-66768: Improper Access Control in SAP NetWeaver (SAP GUI for Java)
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system.
Affected Software
Event History
Frequently Asked Questions
What access and conditions does an attacker need to exploit this issue?
The attacker needs low privileges and must be able to manipulate a backend system connected to SAP GUI for Java. Exploitation also requires user interaction, as indicated by the UI:R vector.
Which systems are exposed?
Systems running SAP GUI for Java are affected when they connect to a backend system that an attacker can manipulate. The issue is on the victim machine, where affected functionality from the backend may lead to command execution.
What is the likely impact of successful exploitation?
Successful exploitation can allow arbitrary command execution on the victim's machine. This can compromise confidentiality, integrity, and availability of that system.