CVE-2026-66778

MEDIUM

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-66778 has a selected CVSS score of 5.3 (medium).

Description

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

SAP Business AI Platform (Approuter)

Browse SAP_SE / SAP Business AI Platform (Approuter)

Default status: unaffected

CVE ListSAP Approuter node.js package < 23.0.0affected

References

3