Approuter (Sap) - vulnerabilities (CVEs)
13 CVEs, 0 in the last 30 days, 198 known versions, newest CVE from 2026-08-11. Vendor: Sap.
CVEs of Approuter
- CVE-2026-66778 - CVSS 5.3 (medium), 2026-08-11: SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send…
- CVE-2026-66777 - CVSS 5.9 (medium), 2026-08-11: SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required…
- CVE-2026-66776 - CVSS 5.9 (medium), 2026-08-11: SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low…
- CVE-2026-66775 - CVSS 4.3 (medium), 2026-08-11: SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a…
- CVE-2026-66774 - CVSS 3.7 (low), 2026-08-11: SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration.…
- CVE-2026-66761 - CVSS 4.3 (medium), 2026-08-11: SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without…
- CVE-2026-66760 - CVSS 6.4 (medium), 2026-08-11: SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same…
- CVE-2026-58239 - CVSS 3.7 (low), 2026-08-11: SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof…
- CVE-2026-58238 - CVSS 5.9 (medium), 2026-08-11: SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that…
- CVE-2026-58237 - CVSS 5.9 (medium), 2026-08-11: WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to…
- CVE-2026-58230 - CVSS 7 (high), 2026-08-11: SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted…
- CVE-2026-44745 - CVSS 8.1 (high), 2026-07-14: SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated…
- CVE-2026-27690 - CVSS 9.1 (critical), 2026-07-14: Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to…
