Critical severity9.0NVD Advisory· Published Sep 8, 2026· Updated Sep 9, 2026
CVE-2026-66768
CVE-2026-66768
Description
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
4- SAP Patches Maximum Severity “Overpass” FlawInfosecurity Magazine · Sep 9, 2026
- SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code ExecutionThe Hacker News · Sep 9, 2026
- SAP Patches Critical Extended Passport Processing VulnerabilitySecurityWeek · Sep 8, 2026
- SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended PassportCyber Security News · Sep 8, 2026