CVE-2026-24317: DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-10 · updated 2026-06-17
Weakness: CWE-427

Description

SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious command is executed in the victim user's context provided GuiXT is enabled. This vulnerability has a low impact on confidentiality, integrity, and availability.

Affected products

SAP_SE SAP GUI for Windows with active GuiXT: BC-FES-GUI 8.00

References

https://me.sap.com/notes/3699761
https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-24317 or the next vulnerability affects your stack