me.sap.com
https://me.sap.com/notes/3786038 CVE-2026-66774
LOW
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
Record summary
CVE-2026-66774 has a selected CVSS score of 3.7 (low).
Description
SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on availability. There is no impact on confidentiality and integrity.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
SAP Business AI Platform (Approuter)Browse SAP_SE / SAP Business AI Platform (Approuter)Default status: unaffected | CVE List | SAP Approuter node.js package < 23.0.0 | affected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-66774 url.sap
https://url.sap/sapsecuritypatchday