CVE-2026-66777: Multiple vulnerabilities in SAP Business AI Platform (Approuter)
SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope. Successful exploitation could allow the attacker to read sensitive data and perform limited modifications on protected resources, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66777?
The severity of CVE-2026-66777 is medium with a score of 5.9.
How do I fix CVE-2026-66777?
To fix CVE-2026-66777, ensure that you apply the latest security patch provided by SAP for the Business AI Platform (Approuter).
What are the potential impacts of CVE-2026-66777?
CVE-2026-66777 may allow an attacker to bypass authorization checks and access protected resources due to insufficient request validation.
What versions are affected by CVE-2026-66777?
CVE-2026-66777 affects certain versions of SAP Business AI Platform (Approuter) that lack proper request validation.
Who can exploit CVE-2026-66777?
An attacker with low privileges can exploit CVE-2026-66777 by sending specially crafted requests to the vulnerable system.