CVE-2026-66768 — Improper Access Control in SAP NetWeaver (SAP GUI for Java)

CVE-2026-66768

Improper Access Control in SAP NetWeaver (SAP GUI for Java) PUBLISHED

Description (CNA)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP NetWeaver (SAP GUI for Java)	affected BC-FES-JAV 8.10

CWE

CWE-807

References

https://me.sap.com/notes/3781729
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.