CVE-2026-66774
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on availability. There is no impact on confidentiality and integrity.
Risk Assessment
The risk for the organization is possible disruptions in applications using Approuter, but only in specific non-default configurations. Low impact on availability and no impact on confidentiality/integrity limit the threat.
Recommendation
Review Approuter configuration for deviations from defaults and apply SAP updates. Monitor service stability and respond to unusual errors.
Original NVD description (English source)
SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on availability. There is no impact on confidentiality and integrity.