CVE-2026-76967

highPriorität · verfolgen · 31EPSS 0.004 · 30. PerzentilNL

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.36% (30th) EPSS

CVSS 7.8 · high

Is it mine?

20 products

Prüfe deine Angriffsfläche

Who says so?

1 sources

ncsc_nl

EPSS · bewertet 2026-10-27

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This results in a high impact on confidentiality, integrity and availability of the application.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · cna@sap.comAusnutzbarkeit 1.8 · Auswirkung 5.9

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-502USCWE-502US

betroffene Produkte (20)

Betroffene Produkte und Versionsbereiche.

SAP Content Server, Internet Communication Manager, Web Dispatcher≤ vers:unknown/*ncsc_nlNL
SAP Extended Passport Processing≤ vers:unknown/*ncsc_nlNL
SAP GUI for Java≤ vers:unknown/*ncsc_nlNL
SAP Integration Suite≤ vers:unknown/*ncsc_nlNL
SAP Manufacturing Integration and Intelligence≤ vers:unknown/*ncsc_nlNL
SAP NetWeaver≤ vers:unknown/*ncsc_nlNL
SAP NetWeaver Business Client≤ vers:unknown/*ncsc_nlNL
SAP NetWeaver Message Server≤ vers:unknown/*ncsc_nlNL
SAP S4HANA≤ vers:unknown/*ncsc_nlNL
SAP SAP Software≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP ABAP Developer Tools≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Cloud Application Programming Model (CAP)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Extended Passport (EPP) Processing≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Integration Suite≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Manufacturing Integration and Intelligence≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP NetWeaver (Message Server)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP NetWeaver (SAP GUI for Java)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP NetWeaver Business Client≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP S/4HANA (Intercompany Matching and Reconciliation)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Web Dispatcher, Internet Communication Manager and SAP Content Server≤ vers:unknown/*ncsc_nlNL

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2026-0356Kwetsbaarheden verholpen in diverse SAP-productenNL2026-09-09csaf · ncsc_nlNL
SAP heeft kwetsbaarheden verholpen in SAP Extended Passport Protocol (EPP) processing library, SAP NetWeaver Message Server, @sap/cds-mtxs NPM library, SAP GUI for Java, SAP ABAP Development Tools voor SAP NetWeaver AS ABAP, SAP Integration Suite, SAP NetWeaver Business Client, SAP Web Dispatcher, Internet Communication Manager, SAP Content Server, SAP S/4HANA Intercompany Matching and Reconciliation module, en SAP Manufacturing Integration and Intelligence.

quellen

Welche Quellen diesen Datensatz belegen und wann.

ncsc_nl NVD CVE.org MITRE

veröffentlicht 2026-09-08geändert 2026-09-09

Referenzen (2) nvd

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan