SAP SE SAP Approuter vulnerabilities

2 vulnerabilities

Known vulnerabilities in SAP SE SAP Approuter, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.1CVE-2026-27690@sapapprouter+2
EPSS score
0.68%
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.8.1CVE-2026-44745@sapapprouter+2
EPSS score
0.47%
SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application.