Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-27690: SAP Approuter can leak data and go offline
CVE-2026-27690 · published 3 months ago
Summary
The SAP Approuter component can be tricked by an unauthenticated attacker into misreading web requests, which may reveal user information and cause the service to stop responding. This affects the confidentiality and availability of the system. Apply the latest security updates from SAP and review your web traffic handling to mitigate the risk.
What to do
- Update sap approuter to version 20.10.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sap_se | sap approuter | SAP Approuter node.js package < 20.10.0 |
| sap | approuter |
< 20.10.0 cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:* |
Original advisory text
SAP Approuter Vulnerable to HTTP Request Smuggling
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Timeline
Published14 Jul 2026
Updated30 Oct 2026
First seen14 Jul 2026
Track software like this
Free during beta