The vulnerability arises from SAP GUI for Java not correctly enforcing trust level policies on functions triggered by a connected backend system. An attacker with low privileges on the backend can exploit this by manipulating the backend to invoke affected functionality, resulting in arbitrary command execution on the client machine. The CVSS 3.1 base score is 9.0, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope change, and high impact on confidentiality, integrity, and availability. No patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation allows arbitrary command execution on the victim's machine, leading to a complete compromise of confidentiality, integrity, and availability of the affected system. This could enable attackers to execute malicious code, access sensitive data, or disrupt system operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor SAP's advisories and consider restricting backend system access to trusted entities to reduce exposure.