SAP GUI For Windows vulnerabilities

5 CVEs affecting SAP GUI For Windows, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-39600, published 2024-07-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-6950, published 2017-03-23. Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days. SAP GUI 7.2 through 7.5 allows remote attackers to bypass intended security policy restrictions and execute arbitrary code via a crafted ABAP code, aka SAP Security Note 2407616.
CVE-2021-27612, published 2021-05-11. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or might lead to phishing attacks to steal…
CVE-2023-32113, published 2023-05-09. Critical severity, CVSS 9.3. EPSS: 0.5% chance of exploitation in the next 30 days. SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a prepared shortcut file. Depending on the…
CVE-2021-40503, published 2021-11-10. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an…
CVE-2024-39600, published 2024-07-09. Medium severity, CVSS 4.2. EPSS: 0.1% chance of exploitation in the next 30 days. Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attacker to get hold of the password and impersonate the…