CVE-2026-66768: CWE-807: Reliance on Untrusted Inputs in a Security Decision in SAP_SE SAP NetWeaver (SAP GUI for Java)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality, potentially leading to arbitrary command execution on the victim's machine. This vulnerability is tracked as CVE-2026-66768 and has a CVSS v3.1 score of 9.0, indicating critical severity with network attack vector, low attack complexity, low privileges required, and user interaction needed. The impact includes high confidentiality, integrity, and availability loss.

Successful exploitation allows arbitrary command execution on the victim's machine, which can severely compromise confidentiality, integrity, and availability of the affected system. This could lead to full system compromise or disruption of services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, organizations should monitor SAP advisories closely and consider restricting access to backend systems that can invoke SAP GUI for Java functions.