CVE-2026-66778: SAP Approuter

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.

Affected products

• SAP Approuter: before 23.0.0 (fixed in 23.0.0)

Published 2026-08-11. Last modified 2026-09-08.