HTTP Request Smuggling Vulnerability in SAP Approuter
CVE-2026-27690

9.1CRITICAL

Key Information:

Vendor

SAP
Status
SAP Approuter
Vendor
CVE Published:
14 July 2026

What is CVE-2026-27690?

The HTTP Request Smuggling vulnerability in SAP Approuter allows unauthenticated attackers to craft malicious HTTP requests, leading to request-response desynchronization. This exploit can expose sensitive user responses and trigger service unavailability, significantly impacting the confidentiality and availability of the affected system.

Affected Version(s)

SAP Approuter SAP Approuter node.js package < 20.10.0

References

https://me.sap.com/notes/3720138
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.