CVE-2026-66775: Multiple vulnerabilities in SAP Business AI Platform (Approuter)

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-24
Weakness: CWE-352

Description

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an attacker-controlled identity, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

Affected products

SAP_SE SAP Business AI Platform (Approuter): before 23.0.0 — fixed in 23.0.0

How to fix

Upgrade to a fixed version: SAP_SE SAP Business AI Platform (Approuter) 23.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-66775 or the next vulnerability affects your stack