CVE-2026-76967

Executive Summary

CVE-2026-76967 is an unauthenticated-code-execution-adjacent (local privilege-context) vulnerability in SAP NetWeaver Business Client caused by insufficient validation of locally stored data processed during application startup. An attacker with low privileges on the local system can replace this data with malicious content; when the application is next launched, the crafted content is processed and can lead to arbitrary code execution in the context of the logged-in user. The vulnerability carries a CVSS v3.1 score of 7.8 (High) with high impacts on confidentiality, integrity, and availability, and is currently unpatched with no vendor fix or workaround published.

Technical Analysis

The NVD description identifies the root cause as CWE-502 — Deserialization of Untrusted Data. SAP NetWeaver Business Client performs insufficient validation when processing "certain locally stored data" during application startup. The precise nature of this data (e.g., configuration files, cached objects, preference stores) is not disclosed in the description; no specific file paths, registry keys, or serialization formats are named.

Attack mechanism at the vulnerability-class level: The application reads and deserializes/processes data from a location that is writable by low-privileged local users. Because the application fails to perform sufficient validation before processing this data, an attacker can substitute a benign payload with specially crafted serialized content. When the application performs deserialization on the next startup, the crafted object is instantiated. In CWE-502 contexts, this typically leads to arbitrary code execution if the deserialization routine respects gadget chains embedded in the object — for example, invoking methods on attacker-controlled classes during object reconstruction.

Key technical facts derived from the data:

• Attack vector: Local (AV:L) — attacker must have a foothold on the target system with low privileges.
• Attack complexity: Low (AC:L) — no special race conditions or advanced techniques required; the attack is straightforward data replacement in a known location.
• Privileges required: Low (PR:L) — the attacker needs only standard user access, not administrator.
• User interaction: None (UI:N) — the victim does not need to click anything; exploitation occurs automatically when the legitimate user next launches SAP NetWeaver Business Client.
• Scope: Unchanged (S:U) — the vulnerability only impacts resources managed by the application/SAP context.
• Impact: High confidentiality, integrity, and availability (C:H/I:H/A:H) — code executes with the privileges of the user who launches the application; because SAP Business Client typically runs with the full rights of an SAP power user, this can expose sensitive ERP data, allow modification of business records, and disrupt availability.

Technical severity assessment: The attack is classified as a "local privilege chain enabler." It is not a privilege escalation to SYSTEM/root (the code runs as the current user), but it bypasses the application's trust boundary by allowing untrusted content to pass through its deserialization layer. In environments where SAP Business Client runs under a high-privileged domain account, the effective impact becomes significantly higher.

No patch, vendor advisory, or CVE description update with further implementation details (specific deserialization libraries, affected file extensions, or versions) is currently available. Insufficient technical detail is available regarding the exact serialization format or the specific local data files involved.

Exploitation Scenarios

Scenario premise: SAP NetWeaver Business Client is deployed on Windows workstations inside an enterprise network. The attacker has already obtained low-privileged local access (e.g., through phishing credentials, a compromised secondary account, or a separate vulnerability).

Step 1 — Reconnaissance/target identification: The attacker enumerates the local system for the installation directory of SAP NetWeaver Business Client and identifies writable locations. This may include per-user configuration directories or shared writable cache areas used by the application on startup. Tools such as dir /s /b or findstr can be used to locate relevant application files; directory ACL inspection identifies which folders are writable by the compromised user.

Step 2 — Triggering the flaw class: Rather than requiring a network call or user interaction, the attacker simply replaces the target local data file with content containing a malicious serialized object. Because CWE-502 describes deserialization of untrusted data, the attacker crafts payload content designed to be interpreted as a benign data structure by the application but which, when deserialized, causes a method call on an unintended class (i.e., a gadget chain). No specific serialization library or file format is disclosed for this CVE, so exploitation depends on the gadget chain available in the SAP Business Client runtime libraries.

Step 3 — Payload/execution method: Execution occurs when a legitimate user launches SAP NetWeaver Business Client. On startup, the application processes the tampered data without sufficient validation. During deserialization, the crafted object invokes runtime methods — commonly via reflection, event handlers, or setter methods — leading to execution of attacker-supplied code (e.g., a command injected into a Runtime.exec() call within a gadget chain) in the context of the logged-in user.

Step 4 — Post-exploitation impact: Once code executes as the authenticated SAP user, the attacker inherits that user's access to SAP backend systems. This can include: reading sensitive business data (financial, HR, PII), extracting credentials or session tokens stored in browser client caches, modifying data by issuing SAP transactions, or abusing RFC/ABAP interfaces for lateral movement inside the SAP landscape. If the desktop user is a domain administrator or SAP super-user, the attacker can expand to full domain compromise via credential theft or token manipulation.

Note on PoC availability: No public PoC or exploit code is available, and no exploit-in-the-wild evidence exists. The attack chain described above is inferred strictly from the vulnerability class (CWE-502) and the CVSS parameters, and the description does not provide specific function names, data file names, or serialization endpoints.

Impact Assessment

CVSS analysis: The vulnerability scores 7.8 (High) — a local vector with low complexity and low privilege required, but no user interaction. The application's processing of untrusted deserialized data leads to symmetric high impact on confidentiality, integrity, and availability (all scored H). The scope remains unchanged — the affected component is the application instance itself, not surrounding infrastructure.

Business impact:

• Confidentiality — High: SAP NetWeaver Business Client is the primary frontend for SAP ERP modules (FI/CO, SD, MM, HR) and BW/BI functions. Users typically operate with broad authorization profiles. Arbitrary code execution in this session context exposes sensitive financial, personnel, and operational data.
• Integrity — High: An attacker can execute code that manipulates SAP transactions, alters master data, or modifies incoming/outbound IDocs, risking false accounting records, fraudulent purchase orders, or corrupted business reporting.
• Availability — High: Malicious payloads can crash the client, corrupt local cache/configuration data (causing persistent application failure), or act as a dropper for malware such as ransomware.

Affected systems: Any endpoint — workstation or virtual desktop infrastructure (VDI) session — where SAP NetWeaver Business Client has been installed and where untrusted low-privileged users share the physical or virtual system. High-risk environments include shared VDI pools, terminal servers, and kiosk workstations in manufacturing plants where SAP client is used by shift workers with shared machine access.

Blast radius: While the vulnerability is local, the downstream impact extends to the entire SAP application landscape reachable by the compromised user's RFC authorizations. In enterprises running SAP GUI-over-HTTP/HTTPS or SAP Business Client with SSO (Kerberos/SAML), the attacker inherits the enterprise identity and can pivot to other integrated systems (HR portals, expense systems, customer portals).

Detection Guidance

Detection of this CWE-502 vulnerability is inherently difficult because the malicious content lives in local files and no network traffic is generated during the attack. Detection should therefore focus on abnormal local file modifications, process behavior anomalies during startup of the SAP client, and unexpected child processes or script interpreter activity.

Sigma Rule

title: Suspicious Local File Modification in SAP NetWeaver Business Client Directory
id: 9a4c99e1-2f6e-4e9b-8a5d-4c7f9b2d1e0a
status: experimental
description: Detects modification of files within the SAP NetWeaver Business Client installation or user-profile directories by processes other than the legitimate updater, potentially indicating tampering for CVE-2026-76967 (local deserialization attack).
author: Valters IT Security Team
date: 2026/01/01
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - '\\SAP Business Client\\'
            - '\\SAP\\NWBC\\'
        # Example paths only (inferred): adjust to the actual install/profile path
    filter_main:
        Image|endswith:
            - '\SAP Business Client\SAPBusinessClient.exe'
            - '\SAPBusinessClient.exe'
            - '\sapgui.exe'
            - '\updater.exe'
    condition: selection and not filter_main
falsepositives:
    - Legitimate patch/update processes of SAP Business Client
    - New installations by administrators
level: medium
tags:
    - attack.t1204.002
    - attack.t1574.007
    - cve.2026-76967

YARA Rule

rule CVE_2026_76967_SAP_BusinessClient_Deserialization_Indicators
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects suspicious serialized data patterns or file modifications associated with CVE-2026-76967 exploitation on SAP NetWeaver Business Client"
        cve = "CVE-2026-76967"
        date = "2026-01-01"
        severity = "high"
    strings:
        // Java serialization magic header (if the application uses Java-based deserialization)
        $java_serial = { AC ED 00 05 }
        // .NET BinaryFormatter header pattern
        $dotnet_serial = { 00 01 00 00 00 FF FF FF FF }
        // Common process execution gadget strings in payloads
        $gadget_exec = "java.lang.Runtime" ascii nocase
        $gadget_process = "System.Diagnostics.Process" ascii nocase
        // Suspicious type identifiers (reflective invocation)
        $reflection = "invoke" ascii nocase
    condition:
        uint16(0) == 0x5A4D or // MZ header check for dropped executable payload
        (1 of ($java_serial, $dotnet_serial) and any of ($gadget_exec, $gadget_process)) or
        (filesize > 10KB and 3 of them)
}

Suricata IDS Rule

Note: This vulnerability operates entirely on the local file system; no network-based detection signature can reliably detect exploitation in transit. The following rule is intentionally generic and targets outbound C2 or command-channel traffic from an infected SAP client host.

alert http any any -> $EXTERNAL_NET any (msg:"ET TROJAN SAP Business Client CVE-2026-76967 Post-Exploitation C2 Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/api/"; http_uri; content:"id="; http_client_body; pcre:"/id=[a-f0-9]{32}/i"; classtype:trojan-activity; sid:2026769671; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-76967;)

Elastic Detection

// Detect suspicious child processes spawned from SAP NetWeaver Business Client processes
// EQL for Windows process events
sequence with maxspan=30s
  [ process where event.code == "1" and
    process.name : ("SAPBusinessClient.exe", "SAPgui.exe", "saplogon.exe") ]
  [ process where event.code == "1" and
    process.parent.name : ("SAPBusinessClient.exe", "SAPgui.exe", "saplogon.exe") and
    process.name : ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "rundll32.exe",
                    "mshta.exe", "regsvr32.exe") and
    not process.command_line : "*sap*" ]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog
| search EventCode=4688
| search ParentProcessName IN ("*SAPBusinessClient.exe", "*sapgui.exe", "*saplogon.exe")
| search NewProcessName IN ("*powershell.exe", "*cmd.exe", "*wscript.exe", "*cscript.exe",
                            "*rundll32.exe", "*mshta.exe", "*regsvr32.exe")
| search NOT NewProcessName IN ("*sap*")
| rex field=NewProcessName ".*\\(?P<process_name>[^\\]+)$"
| stats count by user, host, ParentProcessName, NewProcessName, _time
| sort - _time

Wazuh OSSEC Rule

<group name="sysmon,">
  <rule id="100967" level="12">
    <if_sid>92050</if_sid>  <!-- Sysmon process creation event (EventID 1) -->
    <field name="win.eventdata.parentImage">\.*(SAPBusinessClient|sapgui|saplogon)\.exe</field>
    <field name="win.eventdata.image">\.*(powershell|cmd|cscript|wscript|rundll32|mshta)\.exe</field>
    <description>CVE-2026-76967: Suspicious child process spawned by SAP Business Client – potential code execution</description>
    <group>sysmon,powershell,trojan,</group>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: UNPATCHED. No vendor fix exists; no trusted source has confirmed a patched version. The following measures are interim:

1) Immediate mitigations (hardening until a vendor patch is available):

• Enforce least-privilege directory ACLs: Restrict write access to SAP NetWeaver Business Client installation directories, profile directories, and cache folders to the local Administrators group only. Use icacls to remove modify/write permissions for standard users.
• AppLocker / WDAC policy: Implement application allow-listing to prevent the SAP client from loading non-allowlisted DLLs and to block execution of unsigned script interpreters (PowerShell, cmd, wscript, cscript) from within the SAP process tree.
• Restrict user environments: Consider running SAP Business Client in a separate, hardened virtual desktop session (non-persistent VDI) so that any local tampering is wiped on session reset.
• Monitor and audit: Enable Sysmon (EventID 11 for file creation, EventID 1 for process creation) with policies that target SAP Business Client directories and process lineage; correlate events in your SIEM/SOAR.
• Anti-tamper integrity checks: Script a scheduled task (runs as SYSTEM) to compute SHA-256 hashes of all files under the SAP client directory, compare against a golden baseline, and alert on mismatch.

2) Patch/upgrade steps:

• Subscribe to SAP Security Patch Day (second Tuesday monthly) and SAP OSS Notes with keyword "CVE-2026-76967."
• When a fix is released, apply the updated SAP NetWeaver Business Client package through the SAP Software Download Center.
• Test patched version in a staging environment that mirrors the production SAP GUI/Business Client configuration, with validation on all supported OS versions.

3) Long-term hardening:

• Restrict local user privileges to the minimum required: do not grant local administrator rights to SAP users or domain users routinely.
• Implement and enforce a robust enterprise patch-management cycle for all SAP client software (not only this CVE but future client-side flaws).
• Apply the principle of "secure by configuration": use SAP Application Server to enforce strict transaction-code authorization so that even if the client is compromised, the attacker cannot perform privileged business transactions directly.
• Maintain backups of local SAP client configurations; in the event of detection or suspicion of tampering, revert the affected system to a clean image and rotate the affected user's credentials.