CVE-2026-24317Medium· 5.0▾ SunlitSAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious command is executed in the victim user's context provided GuiXT is enabled. This vulnerability has a low impact on confidentiality, integrity, and availability.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-41730Critical· 9.8Missing Authentication check in SAP BusinessObjects Business Intelligence Platform
CVE-2025-43001Medium· 6.9Multiple Privilege Escalation Vulnerabilities in SAPCAR
CVE-2025-42992Medium· 6.9Multiple Privilege Escalation Vulnerabilities in SAPCAR
CVE-2025-42917Medium· 6.5Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application)
CVE-2025-42953High· 8.1Missing Authorization check in SAP NetWeaver Application Server for ABAP
CVE-2025-42989Critical· 9.6Missing Authorization check in SAP NetWeaver Application Server for ABAP