What’s Vulnerable › Vulnerabilities

CVE-2026-66777: Multiple vulnerabilities in SAP Business AI Platform (Approuter)

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-22

Description

SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope. Successful exploitation could allow the attacker to read sensitive data and perform limited modifications on protected resources, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

Affected products

• SAP_SE SAP Business AI Platform (Approuter): before 23.0.0 — fixed in 23.0.0

How to fix

Upgrade to a fixed version: SAP_SE SAP Business AI Platform (Approuter) 23.0.0. Check the vendor advisory for mitigations.

References

• https://me.sap.com/notes/3786038
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-66777 or the next vulnerability affects your stack