Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-66774: SAP Approuter does not consistently handle certain error conditions

25
Routine
LOW 3.7REMOTEUPGRADE

CVE-2026-66774 is a low-severity flaw (CVSS 3.7) affecting approuter. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on availability. There is no impact on confidentiality and integrity.

Why this priority

  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score3.7 (Low)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededNone
User interactionNone
EPSS exploit chance0.4% (top 72%)
CISA exploited listNo
WeaknessCWE-754
Published2026-08-11
Last modified2026-10-23
Publisher (CNA): SAP SE · Vendor: sap

Am I affected?

Timeline

sap approuter UPGRADE
Affected: < 23.0.0
Fixed in: 23.0.0
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls approuter
2. UPGRADE to 23.0.0
npm install approuter@">=23.0.0"
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

References

← Back to latest CVEs