Vulnerability intelligence
CVE-2026-66768
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system.
CVSS Score
9
Critical
EPSS — Exploit Probability
0.6%
Riskier than 49% of all CVEs · checked 2026-10-22
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
4 articles across 4 outlets · first covered Sep 8, 2026 · latest Sep 9, 2026
Coverage timeline
-
SAP Patches Critical SAP Flaws Enabling Unauthenticated RCEthehackernews.com · Sep 9, 2026
-
Over 10,000 SAP Systems Exposed to Critical Kernel Flawwww.infosecurity-magazine.com · Sep 9, 2026
-
SAP Fixes Critical EPP Flaw Allowing Full System Compromisewww.securityweek.com · Sep 8, 2026
-
SAP Patches Critical EPP Flaw Exposing Systems to Memory Corruptionsecurityonline.info · Sep 8, 2026