PatchTheCEVsap vulnerabilities
Recent CVEs affecting sap products. 11 tracked.
sap has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 11. Most recent: 2026-08-11. Highest priority: CVE-2026-58230 (score 35/100).
- CVE-2026-58230 HIGH 7.0 UPGRADE SAP Approuter does not sufficiently validate certain token content under specific configurations
- CVE-2026-58238 MEDIUM 5.9 UPGRADE SAP Approuter does not sufficiently handle certain requests under specific conditions
- CVE-2026-66778 MEDIUM 5.3 UPGRADE SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal com
- CVE-2026-66777 MEDIUM 5.9 UPGRADE SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend desti
- CVE-2026-58237 MEDIUM 5.9 UPGRADE WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality
- CVE-2026-58239 LOW 3.7 UPGRADE SAP Approuter does not sufficiently validate tenant context in inbound requests
- CVE-2026-66774 LOW 3.7 UPGRADE SAP Approuter does not consistently handle certain error conditions
- CVE-2026-66760 MEDIUM 6.4 UPGRADE SAP Approuter does not correctly validate client certificates in certain callback flows
- CVE-2026-66761 MEDIUM 4.3 UPGRADE SAP Approuter does not enforce sufficient flow control in certain functionality
- CVE-2026-66776 MEDIUM 5.9 UPGRADE SAP Approuter does not consistently enforce integrity verification on certain session-related request headers
- CVE-2026-66775 MEDIUM 4.3 UPGRADE SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default
FAQ
How do I fix sap vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sap being exploited right now?
None of the tracked sap CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sap CVE should I patch first?
CVE-2026-58230 currently ranks highest (35/100): SAP Approuter does not sufficiently validate certain token content under specific configurations.