Arbitrary Command Execution Vulnerability in SAP GUI for Java
CVE-2026-66768

9CRITICAL

Key Information:

Vendor: SAP
Status: SAP Netweaver (SAP Gui For Java)
Vendor: CVE Published:; 8 September 2026

What is CVE-2026-66768?

SAP GUI for Java has a vulnerability that fails to correctly enforce the trust level policy when functions are invoked from a connected backend system. This allows a low-privileged attacker to exploit the weakness by manipulating the backend system. Successful exploitation could enable arbitrary command execution on the victim's machine, which poses significant risks to the confidentiality, integrity, and availability of the affected system.

Affected Version(s)

SAP NetWeaver (SAP GUI for Java) BC-FES-JAV 8.10

References

https://me.sap.com/notes/3781729

https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 8, 2026
Vulnerability Reserved
Jul 27, 2026

CVE-2026-66768 Data

JSON