CVE-2026-66778: sap_se sap business ai platform (approuter)

Vulnerability summary

CVE-2026-66778 is a medium (CVSS 5.3) vulnerability in sap_se sap business ai platform (approuter). EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.2% of scored vulnerabilities.

Timeline

1. 11-08-2026
   PublishedVulnerability first disclosed.
2. 11-08-2026
   Last modifiedVulnerability information updated.

Description

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.

• CWE-644Improper Neutralization of HTTP Headers for Scripting SyntaxThe product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.