Is CVE-2026-66778 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-66778?

CVE-2026-66778 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-66778

Description

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.