CVE-2026-66778
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information.
Risk Assessment
The vulnerability has a low impact on confidentiality, with no impact on integrity and availability. It could lead to disclosure of limited internal data.
Recommendation
Update SAP Approuter to the latest version and implement additional header validation at the proxy or firewall level.
Original NVD description (English source)
SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.