NetWeaver Business Client CVE-2026-76967

Exploitation requires an authenticated local account on the same system as the targeted SAP NetWeaver Business Client installation, with filesystem write access to the directories or files that the application reads during startup. The attacker does not need administrative privileges - PR:L (low) suffices. The attack is latent: the payload is staged in advance and fires automatically when the victim user next launches the application (no further attacker interaction required at that point). Exploitation is constrained to local-only access (AV:L) - remote unauthenticated exploitation is not possible. Scope is contained to the victim user's session context (S:U), so root or SYSTEM-level compromise is not directly achieved unless the user runs with elevated rights. The vulnerability is not exploitable on systems where SAP NetWeaver Business Client startup data paths are writable only by the owning user account.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local, low-complexity attack path with full CIA impact, though the AV:L constraint is a meaningful real-world limiter - exploitation requires an authenticated foothold on the victim's workstation. The AC:L rating is appropriate since file replacement requires no special timing or race conditions. PR:L correctly captures that any authenticated local user (or malware already running at that privilege level) can stage the attack. EPSS data is absent from input; given the local-only attack vector and enterprise deployment context, real-world risk skews toward insider threat and post-compromise lateral movement scenarios rather than mass internet exploitation. No KEV listing and no public POC further support treating this as a measured rather than urgent priority for organizations without shared workstation environments. The highest realistic risk scenario is a multi-user SAP terminal server or kiosk where multiple employees share OS-level access.

An attacker with a low-privileged local account on a shared workstation - or malware already running at user level - identifies the locally stored data files read by SAP NetWeaver Business Client at startup and replaces them with a crafted deserialization payload. The next time the legitimate SAP user launches the client application, the malicious payload is deserialized and arbitrary code executes silently in the context of that user's session, potentially harvesting SAP credentials or establishing persistent access.