Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-66776: SAP Approuter does not consistently enforce integrity verification on certain session-related request headers

23
Routine
MEDIUM 5.9UPGRADE

CVE-2026-66776 is a medium-severity flaw (CVSS 5.9) affecting approuter. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could r

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score5.9 (Medium)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededLow
User interactionNone
EPSS exploit chance0.2% (top 91%)
CISA exploited listNo
WeaknessCWE-347
Published2026-08-11
Last modified2026-10-23
Publisher (CNA): SAP SE · Vendor: sap

Am I affected?

Timeline

sap approuter UPGRADE
Affected: < 23.0.0
Fixed in: 23.0.0
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls approuter
2. UPGRADE to 23.0.0
npm install approuter@">=23.0.0"
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

References

← Back to latest CVEs