CVE-2026-66775: sap_se sap business ai platform (approuter) Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2026-66775 is a medium (CVSS 4.3) Cross-Site Request Forgery (CSRF) vulnerability in sap_se sap business ai platform (approuter). EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.3% of scored vulnerabilities.

Timeline

1. 11-08-2026
   PublishedVulnerability first disclosed.
2. 11-08-2026
   Last modifiedVulnerability information updated.

Description

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an attacker-controlled identity, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.