Advisory
A note with CVSS 7.8 for component BC-FES-BUS was released by SAP on 08.09.2026. The correction/advisory 3784138 was described with "[CVE-2026-76967] Insecure Deserialization in SAP NetWeaver Business Client" and affects the system type SAP Business Client.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as none.
The vulnerability addressed is insecure deserialization within SAP Business Client.
Risk specification
SAP NetWeaver Business Client does not sufficiently validate certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is launched again, the manipulated content is processed and could result in arbitrary code execution in the context of the user. This could have a high impact on the confidentiality, integrity, and availability of the application.
Solution
With the correction provided in this SAP Security Note, the SAP Business Client application securely serializes data on the client PC. Apply the Support Packages and Patches referenced in this SAP Security Note. Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "None".
The advisory is valid for
- BC-WD-CLT-BUS 8.00
- BC-WD-CLT-BUS 8.10
