CVE-2026-66776
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context.
Risk Assessment
Exploitation requires the attacker to have previously observed matching session values out-of-band, making the attack complex. This could result in a high impact on confidentiality and a low impact on integrity, with no impact on availability.
Recommendation
Update SAP Approuter and implement additional session integrity verification mechanisms, such as header signing.
Original NVD description (English source)
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.