CVE-2026-76967: SAP NetWeaver Business Client RCE Vulnerability

CVE-2026-76967 Overview

CVE-2026-76967 is an insecure deserialization vulnerability [CWE-502] affecting SAP NetWeaver Business Client. The application fails to sufficiently validate certain locally stored data during startup. A low-privileged local attacker can replace this data with crafted content that the application processes on next launch. Successful exploitation results in arbitrary code execution in the context of the current user, compromising confidentiality, integrity, and availability of the application.

Critical Impact
A local attacker with limited privileges can achieve arbitrary code execution in the user's context by tampering with local data files consumed by SAP NetWeaver Business Client at startup.

Affected Products

SAP NetWeaver Business Client
Refer to SAP Note #3784138 for the authoritative list of affected component versions
Deployments where local users can write to the client's data storage paths

Discovery Timeline

2026-09-08 - CVE-2026-76967 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-76967

Vulnerability Analysis

SAP NetWeaver Business Client reads locally stored data during application startup without performing sufficient integrity or type validation. The classification under [CWE-502] indicates the client deserializes or otherwise interprets attacker-controllable data structures before applying appropriate checks.

Because the trigger occurs during normal application launch, exploitation requires no additional user interaction beyond the victim starting the client. The attack executes in the user's security context, granting access to whatever resources that user can reach, including SAP session data, cached credentials, and connected backend systems.

The issue is local in scope. The attacker must already hold low-privileged access on the workstation, either through a compromised standard account, a malicious insider, or a prior foothold established via phishing or another initial-access technique.

Root Cause

The root cause is insufficient validation of persisted client-side data at load time. Applications that deserialize objects, configuration blobs, or state files must validate structure, type, and integrity before instantiation. When these checks are absent, crafted serialized content can trigger code paths that lead to arbitrary code execution, as described in the SAP advisory.

Attack Vector

The attacker overwrites a specific file or data store consumed by SAP NetWeaver Business Client during initialization. This typically resides in a user-writable directory under the victim's profile. When the victim next launches the client, the crafted content is parsed and processed, executing attacker-controlled logic. See SAP Note #3784138 for technical specifics on the affected code path and vulnerable data location.

No verified proof-of-concept code is publicly available for this vulnerability at the time of publication.

Detection Methods for CVE-2026-76967

Indicators of Compromise

Unexpected modifications to SAP NetWeaver Business Client local data or configuration files by non-administrative processes
Child processes spawned by the NetWeaver Business Client executable that are inconsistent with normal client operation, such as command interpreters or scripting hosts
Outbound network connections from the client process to hosts outside the organization's SAP backend range following application startup

Detection Strategies

Monitor file writes to the NetWeaver Business Client user data directories and flag writes originating from processes other than the client itself or authorized installers
Baseline the process tree of the NetWeaver Business Client at startup and alert on anomalous child processes or DLL loads
Correlate local file-tampering events with subsequent client launches to identify the persistence-to-execution transition

Monitoring Recommendations

Enable file integrity monitoring on SAP client installation and user profile paths on all workstations running NetWeaver Business Client
Collect endpoint process, file, and module-load telemetry into a central data lake for retrospective hunting against the [CWE-502] deserialization pattern
Review endpoint detection and response alerts for behavioral indicators of code execution in user context immediately after SAP client startup

How to Mitigate CVE-2026-76967

Immediate Actions Required

Apply the fix described in SAP Note #3784138 as prioritized in the SAP Security Patch Day release
Inventory all workstations running SAP NetWeaver Business Client and confirm patch deployment status
Restrict local administrative and interactive access on hosts running the client to reduce the population of potential low-privileged attackers

Patch Information

SAP has released a security fix through the SAP Security Patch Day process. Customers should consult SAP Note #3784138 for the specific patched versions, download instructions, and any prerequisites. Deploy the patch to all endpoints running SAP NetWeaver Business Client and validate installation through standard change-management procedures.

Workarounds

If patching cannot be completed immediately, apply strict access control lists on the local directories that store NetWeaver Business Client startup data so only the intended user and administrators can write to them
Enforce least-privilege on workstations to prevent shared or service accounts from writing to another user's SAP client data
Monitor and alert on any modification to the client's local data files pending patch deployment

bash

# Example: restrict write access to a user's SAP client data directory on Windows
# Replace <User> and <Path> with the appropriate values from SAP Note #3784138
icacls "<Path>" /inheritance:r
icacls "<Path>" /grant:r "<User>:(OI)(CI)M" "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"
icacls "<Path>" /remove "Users" "Everyone"