Description
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This results in a high impact on confidentiality, integrity and availability of the application.
Published: 2026-09-08
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

SAP NetWeaver Business Client does not adequately validate locally stored data that is processed during application startup. An attacker with low local privileges can replace this data with crafted content, leading to arbitrary code execution when the application is launched. The vulnerability impacts confidentiality, integrity, and availability of the system.

Affected Systems

The affected product is SAP NetWeaver Business Client from SAP SE. No specific version information is provided in the advisory.

Risk and Exploitability

The CVSS score is 7.8, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Since local privileges are required, the attack vector is inferred to be local. The overall risk is significant, especially in environments where local accounts may be compromised or have higher privileges.

Generated by OpenCVE AI on September 8, 2026 at 01:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the security update referenced by SAP Note 3784138.
  • Upgrade SAP NetWeaver Business Client to the latest supported patch level.
  • Restrict local user permissions for files used at application startup and monitor for unauthorized changes.

Generated by OpenCVE AI on September 8, 2026 at 01:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 00:45:00 +0000

Type Values Removed Values Added
Description SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This results in a high impact on confidentiality, integrity and availability of the application.
Title Insecure Deserialization in SAP NetWeaver Business Client
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-09-08T00:12:32.552Z

Reserved: 2026-08-20T05:15:36.824Z

Link: CVE-2026-76967

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-08T01:17:55.170

Modified: 2026-09-08T01:17:55.170

Link: CVE-2026-76967

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T01:30:06Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data