CVE-2026-66776: sap_se sap business ai platform (approuter)

Vulnerability summary

CVE-2026-66776 is a medium (CVSS 5.9) vulnerability in sap_se sap business ai platform (approuter). EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.3% of scored vulnerabilities.

Timeline

1. 11-08-2026
   PublishedVulnerability first disclosed.
2. 11-08-2026
   Last modifiedVulnerability information updated.

Description

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

• CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.