SAP GUI for Java EUVD-2026-72577

Exploitation requires a connected backend SAP system that the attacker can manipulate or control (consistent with PR:L) and a victim who actively connects and interacts with that backend via SAP GUI for Java (UI:R). The attacker must be able to influence backend responses so they invoke the specific client functions gated by the trust-level policy; exploitation is limited by needing that backend foothold, an active client session with user interaction, and the SAP GUI for Java client rather than the Windows SAP GUI variant. It is not exploitable against a client that never connects to an attacker-influenced backend.

The signals are internally consistent for a serious client-side RCE: AV:N/AC:L means the trigger crosses the network from the backend with low complexity; PR:L reflects that the attacker needs some foothold on/into a connected backend; UI:R means a user must be connected and interacting with the malicious server; and S:C with C:H/I:H/A:H captures that a compromised backend crosses a trust boundary to fully compromise a separate client workstation, which is what drives the 9.0. The practical constraint is meaningful - this is not a mass-scannable internet exposure but a scenario requiring a rogue or compromised backend and an active client session, so exploitation is more targeted than opportunistic; no EPSS score, KEV listing, or public POC is provided, and there is no public exploit identified at time of analysis, which lowers near-term wormable risk while leaving supply-chain-style backend-compromise scenarios credible. Given SAP GUI's role as an administrative client, any organization running it against SAP landscapes should treat this as urgent patching regardless of size. Note the input Tag 'Information Disclosure' understates the impact - the described outcome is arbitrary command execution (full CIA impact), not mere disclosure.

An attacker who has gained low-privileged control over an SAP backend (or stands up a rogue server a user is lured into connecting to) crafts a response that invokes a client function which the trust policy should have blocked. When a user opens or interacts with a transaction against that backend using SAP GUI for Java, the client executes attacker-chosen OS commands on the workstation. No public exploit is identified at time of analysis, but the low attack complexity makes reliable exploitation plausible for an attacker positioned on the backend.