SAP Approuter Vulnerability Exposing Internal Components

CVE-2026-66778

What is CVE-2026-66778?

SAP Approuter suffers from a flaw where it inadequately sanitizes specific request headers before relaying traffic to internal components. As a result, an unauthenticated attacker can craft a malicious request to gain limited unauthorized access to sensitive information. While the potential impact on confidentiality is low, there are no implications for data integrity or system availability. It is crucial for users and administrators to be aware of this vulnerability and apply any available patches or updates.

References