CVE-2026-66778

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.

Score

CVSS 3.1 5.3 Medium

Status

Analyzed - cna@sap.com

Published

2026-08-11

Last modified

2026-10-24

Weaknesses

CWE-644

Affected products

• Approuter (Sap)
• Sap Business Ai Platform Approuter (Sap Se)

References

• https://me.sap.com/notes/3786038
• https://url.sap/sapsecuritypatchday