CVE-2026-66774

SAP Approuter in SAP Business AI Platform contains multiple vulnerabilities related to error handling under non-default configurations. An attacker with low privileges could exploit conditions outside their control to affect availability , with no impact on confidentiality or integrity reported. ...

EUVD-2026-55886

SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on...

CVE-2026-66761

CVE-2026-66761: SAP Approuter in SAP Business AI Platform suffers from insufficient flow control allowing a low-privilege attacker to send large volumes of data, leading to unbounded memory growth and low availability impact. No impact on confidentiality or integrity is claimed. CVSS 3.1 base sco...

EUVD-2026-55879

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...

EUVD-2026-55878

SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute...

CVE-2026-66760

Technical details about CVE-2026-66760 are not publicly available in the provided documents beyond what is described in the Initial Description; monitor for updates.

CVE-2026-58239

CVE-2026-58239 affects SAP Approuter in SAP Business AI Platform. The issue arises from insufficient validation of tenant context in inbound requests, allowing an unauthenticated attacker to spoof tenant context under conditions not fully within their control. This could lead to limited exposure ...

EUVD-2026-55871

SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's...

EUVD-2026-55870

SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex t...

CVE-2026-58238

CVE-2026-58238 affects SAP Approuter in SAP Business AI Platform. The vulnerability arises from insufficient handling of certain requests under specific runtime conditions, allowing an unauthenticated attacker to craft input that causes the component to crash and restart. Impact is limited to ava...

EUVD-2026-55869

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited...

CVE-2026-58237

CVE-2026-58237 concerns multiple vulnerabilities in SAP Business AI Platform (Approuter). The WebSocket component allegedly fails to perform sufficient authorization checks in certain functionality, allowing a low-privileged attacker to access restricted functionality and potentially read sensiti...

EUVD-2026-55866

SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to...

CVE-2026-58230

CVE-2026-58230 affects SAP Approuter in SAP Business AI Platform. An unauthenticated attacker can use a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination due to insufficient validation of token content. This yields high impact on confi...

PT-2026-70039

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to enforce sufficient flow control in certain functionality. A low-privileged attacker can send high volumes of data without consuming responses, leading to unbounde...

PT-2026-70050

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently sanitize certain request headers before forwarding traffic to internal components. This allows an unauthenticated attacker to send a specially crafte...

PT-2026-70026

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently validate certain token content under specific configurations. An unauthenticated attacker can send a specially crafted token to force the transmissio...

PT-2026-70038

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to correctly validate client certificates during specific callback flows. An attacker with low privileges who possesses a certificate issued by the same trusted...

PT-2026-70047

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter does not enforce cross-site request forgery CSRF protection on the authentication flow by default. CSRF is a type of attack that tricks a victim into submitting a maliciou...

PT-2026-70048

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to consistently enforce integrity verification on specific session-related request headers. A low-privileged attacker can send a specially crafted request to bypass...