CVE-2026-24317

SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious command is executed in the victim user's context provided GuiXT is enabled. This vulnerability has a low impact on confidentiality, integrity, and availability.

• CWE-427

• https://me.sap.com/notes/3699761
• https://url.sap/sapsecuritypatchday

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24311The SAP Customer Checkout application exhibits certain desig…5.6
• CVE-2026-24312An erroneous authorization check in SAP Business Workflow le…5.2
• CVE-2026-24313SAP Solution Tools Plug-In (ST-PI) contains a function modul…5
• CVE-2026-24314Under certain conditions SAP S/4HANA (Manage Payment Media) …4.3
• CVE-2026-24315SAP Fiori Launchpad allows attackers to craft malicious URLs…4.2
• CVE-2026-24316SAP NetWeaver Application Server for ABAP provides an ABAP R…6.4
• CVE-2026-24318Due to an Insecure session management vulnerability in SAP B…4.2
• CVE-2026-24319In SAP Business One, sensitive information is written to the…5.8
• CVE-2026-2432The CM Custom Reports – Flexible reporting to track what mat…4.4
• CVE-2026-24320Due to improper memory management in SAP NetWeaver and ABAP …3.1
• CVE-2026-24321SAP Commerce Cloud exposes multiple API endpoints to unauthe…5.3
• CVE-2026-24322SAP Solution Tools Plug-In (ST-PI) contains a function modul…7.7