high2026-09-08SAP NetWeaver Business ClientCVE-2026-76967
Insecure Deserialization in SAP NetWeaver Business Client
SAP NetWeaver Business Client
Our Take
Another client-side deserialization flaw — local access requirement reduces immediate exposure but spear-phishing or file drop attacks are realistic delivery vectors. NWBC 8.00/8.10 is the current desktop client for many NetWeaver installations. Prioritize workstations running NWBC with elevated SAP roles.
Vulnerability Detail
Arbitrary code execution possible via insecure deserialization of crafted data in locally stored files. Client-side component flaw requiring local access or a malicious file delivery mechanism.
Patch Action
Update SAP NetWeaver Business Client to the patched version per SAP Note 3784138. Coordinate with desktop support teams for client-side deployment.
Affected Versions
BC-WD-CLT-BUS 8.00
8.10
Patch Info