Sap_se Sap Business Ai Platform (Approuter)
11 CVEs affecting Sap_se Sap Business Ai Platform (Approuter). Latest disclosed: 2026-08-11. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-58230 | High | 7.0 | 2026-08-11 | SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted to… |
CVE-2026-66760 | Medium | 6.4 | 2026-08-11 | SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same t… |
CVE-2026-66777 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required co… |
CVE-2026-66776 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low p… |
CVE-2026-58238 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that caus… |
CVE-2026-58237 | Medium | 5.9 | 2026-08-11 | WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to acc… |
CVE-2026-66778 | Medium | 5.3 | 2026-08-11 | SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a… |
CVE-2026-66775 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious… |
CVE-2026-66761 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consum… |
CVE-2026-66774 | Low | 3.7 | 2026-08-11 | SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Succ… |
CVE-2026-58239 | Low | 3.7 | 2026-08-11 | SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the… |