CVE-2026-24317

Description

SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious command is executed in the victim user's context provided GuiXT is enabled. This vulnerability has a low impact on confidentiality, integrity, and availability.

PUBLISHED Reserved 2026-01-21 | Published 2026-03-10 | Updated 2026-03-11 | Assigner sap

Problem types

CWE-427: Uncontrolled Search Path Element

Product status

References

me.sap.com/notes/3699761

url.sap/sapsecuritypatchday

cve.org (CVE-2026-24317)

nvd.nist.gov (CVE-2026-24317)

Download JSON