CVE-2026-66776
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
52/100
Published: 2026-08-11
Modified: 2026-10-24
First seen: 2026-10-29
Status: active
Attack Surface
Network
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
Low
A:
None
Description
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
Weakness Classification (1)
References & Advisories (2)
Vendor Advisory
Permissions Required