Read the docs
TI-2021-09064 Aliases CVE-2021-27612GHSA-89x7-8rj3-46vw

Open redirect in SAP GUI for Windows

Priority LOW 28CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.

Summary

In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or might lead to phishing attacks to steal credentials of the victim.

Why it matters now

EPSS 0.00618 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP GUI for Windows< 7.60 PL10; < 7.70 PL1—No fix listedCNA
  • SAP GUI for Windows VendorSAP Affected < 7.60 PL10; < 7.70 PL1 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:sap:gui_for_windows:7.60:-:*:*:*:*:*:*7.60VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level1:*:*:*:*:*:*7.60 patch_level1VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level2:*:*:*:*:*:*7.60 patch_level2VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level3:*:*:*:*:*:*7.60 patch_level3VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level4:*:*:*:*:*:*7.60 patch_level4VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level5:*:*:*:*:*:*7.60 patch_level5VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level6:*:*:*:*:*:*7.60 patch_level6VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level7:*:*:*:*:*:*7.60 patch_level7VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8:*:*:*:*:*:*7.60 patch_level8VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8_hotfix1:*:*:*:*:*:*7.60 patch_level8_hotfix1VulnerableSAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:-:*:*:*:*:*:* Versions 7.60 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level1:*:*:*:*:*:* Versions 7.60 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level2:*:*:*:*:*:* Versions 7.60 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level3:*:*:*:*:*:* Versions 7.60 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level4:*:*:*:*:*:* Versions 7.60 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level5:*:*:*:*:*:* Versions 7.60 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level6:*:*:*:*:*:* Versions 7.60 patch_level6 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level7:*:*:*:*:*:* Versions 7.60 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8:*:*:*:*:*:* Versions 7.60 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8_hotfix1:*:*:*:*:*:* Versions 7.60 patch_level8_hotfix1 Vulnerable ·SAP
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level9:*:*:*:*:*:*7.60 patch_level9VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:-:*:*:*:*:*:*7.70VulnerableSAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level9:*:*:*:*:*:* Versions 7.60 patch_level9 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:-:*:*:*:*:*:* Versions 7.70 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27612
  2. 2026-10-03 Alias added: GHSA-89x7-8rj3-46vw

References

Advisory 2

  • TI-2017-04660 SAP GUI 7.2 through 7.5 allows remote attackers to bypass intended security policy… CVSS 3.0CRITICAL 9.8
  • TI-2023-15416 Information Disclosure vulnerability in SAP GUI for Windows CVSS 3.1CRITICAL 9.3
  • TI-2021-17550 Insufficiently protected credentials in SAP GUI for Windows CVSS 3.1HIGH 7.8
  • TI-2024-26530 [CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows CVSS 3.1MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences