Description

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This results in a high impact on confidentiality, integrity and availability of the application.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-08T01:17:55.170Z",
  "pubdate": "2026-09-08T01:17:55.170Z",
  "executiveSummary": "SAP NetWeaver Business Client contains a critical vulnerability stemming from insufficient validation of locally stored data processed during application initialization.\nThis flaw allows an attacker with low-level local access to the host system to manipulate specific local data files. By replacing these files with specially crafted content, an attacker can trigger arbitrary code execution within the security context of the user running the application.\nThe vulnerability represents a high risk to the confidentiality, integrity, and availability of the affected system. Successful exploitation effectively grants the attacker the same permissions as the victim user, enabling unauthorized access to sensitive application data and potential system-wide compromise if the user possesses elevated privileges.\nExploitation requires the attacker to have local access to the machine where SAP NetWeaver Business Client is installed. The attack is triggered during the application's startup sequence when it implicitly trusts and processes the compromised local data files. As this is a local privilege escalation vector, it bypasses network-based security controls, necessitating robust endpoint security measures and strict management of local file system permissions.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of data ingestion during the startup phase of SAP NetWeaver Business Client. The application fails to implement cryptographic verification or integrity checks on locally stored configuration or support files before they are processed by the core executable engine.\nThe vulnerability is characterized as an insecure file handling issue leading to arbitrary code execution. Because the application processes these user-writable files as trusted input, the data can be manipulated to inject malicious payloads—such as shellcode, dynamic link libraries (DLLs), or malicious script objects—that the application subsequently parses or executes as part of its initialization routine.\nThe attack flow follows a predictable sequence: First, the attacker identifies the specific file paths on the local file system where SAP NetWeaver Business Client caches or stores configuration and startup data. Second, leveraging low-privileged access, the attacker replaces legitimate files with malicious counterparts. Third, the attacker waits for the application to be launched by a legitimate user. Upon invocation, the application reads the tampered data. Due to the lack of validation, the application interprets the injected content as legitimate instructions. Finally, the application executes the malicious content, granting the attacker full control over the process environment under the current user's security context.\nThe impact of this exploitation is severe. Because code execution occurs within the context of the running application, the attacker inherits the security tokens and access rights associated with that user session. This permits the attacker to bypass access controls, manipulate application data, extract stored credentials, or install persistent backdoors on the local workstation. The absence of validation mechanisms constitutes a significant design failure in the input processing pipeline, as the application relies on the assumption that local data stores remain immutable and trustworthy, which is a common fallacy in multi-user environments where local privilege escalation is a viable threat vector."
}