Read the docs
TI-2021-04546 Aliases CVE-2021-21448GHSA-6cmw-q525-v9j6

SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for…

Priority LOW 29Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on the client PC and not via Network and the attacker needs at least user authorization of the Operating System user of the victim.

Why it matters now

EPSS 0.0029 21st percentileScored 2026-11-07
Fix Fixed SAP GUI FOR WINDOWS (SAP SE): 7.60

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP GUI FOR WINDOWSbefore 7.607.60Patch availableCNA
  • SAP GUI FOR WINDOWS VendorSAP Affected before 7.60 Fixed in 7.60 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sap:graphical_user_interface:7.60:*:*:*:*:windows:*:*7.60VulnerableSAP
  • cpe:2.3:a:sap:graphical_user_interface:7.60:*:*:*:*:windows:*:* Versions 7.60 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP GUI FOR WINDOWS (SAP SE) Fixed in 7.60

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21448
  2. 2026-10-03 Alias added: GHSA-6cmw-q525-v9j6

References

Advisory 1

Other 1

  • TI-2023-27078 Information disclosure in SAP GUI for Windows and SAP GUI for Java CVSS 3.1HIGH 7.3
  • TI-2011-04431 Multiple untrusted search path vulnerabilities in (1) SAPGui.exe and (2) BExAnalyzer.exe… CVSS 2.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences