CVE-2026-27690

CriticalCVSS 9.1

Published: 14/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

42th percentile - higher than 42% of all known CVEs

Summary

An HTTP Request Smuggling vulnerability in SAP Approuter allows an unauthenticated attacker to send a crafted HTTP request, causing request-response desynchronization. This can expose user responses and make the system unavailable, with high impact on confidentiality and availability.

Risk Assessment

The risk for the organization includes leakage of sensitive user data and service disruption, affecting both confidentiality and availability.

Recommendation

Immediately update SAP Approuter to the latest patched version and deploy WAF rules to block suspicious HTTP requests.

Original NVD description (English source)

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.