CVE-2026-66768

Katalog CVE

CVSS 9.0 · Critical EPSS 0,61%

Kerentanan Reliance on Untrusted Inputs in a Security Decision. Skor CVSS 3.1 9.0 (Critical) menurut sap.com.

Deskripsi (NVD)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system.

Rincian

Terbit di NVD

8 September 2026

Terakhir diubah

9 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

9.0 (Critical), sumber sap.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://me.sap.com/notes/3781729
• https://url.sap/sapsecuritypatchday