CVE-2026-27690Patch(sap / approuter)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch sap approuter systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

sap CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://url.sap/sapsecuritypatchday

Other references

https://me.sap.com/notes/3720138

Weakness type (CWE)

CWE-444

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

approuter

Threat summary

Patch or workaround signal is available
9 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 6 signals
Technical details provided in 8 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 4d ago at 3 mentions (2026-07-14); latest day: 1
9 total mentions across 5 days

Affected systems

Vendors

sap

Products

approuter

Deep dive

Activity timeline9 mentions / 5d

Signal classification3 categories

Patch

777.8%

Disclosure

111.1%

General

111.1%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-14	3	Patch3
2026-07-15	3	Disclosure1Patch2
2026-07-16	1	Patch1
2026-07-22	1	General1
2026-08-09	1	Patch1

Full discourse9 posts

Modat@modat_magnify90d
Patch
⚠️SAP NetWeaver AS ABAP – Out-of-Bounds Write / Memory Corruption (CVSS 9.9) SAP has patched CVE-2026-44747, a critical out-of-bounds write flaw in SAP NetWeaver Application Server ABAP, as part of its July 2026 Security Patch Day. An authenticated attacker can leverage logical errors in memory management to trigger memory corruption, potentially leading to unauthorised data access, data modification, or system unavailability. It was fixed alongside two other critical flaws: CVE-2026-27690 (CVSS 9.1), an HTTP request/response smuggling issue in SAP Approuter, and CVE-2026-44761 (CVSS 9.1), a default-credentials flaw in SAP Commerce Cloud. Mitigation: Install the patched ABAP Kernel version per SAP's July 2026 notes. As a temporary workaround, SAP proposes disabling all ICF nodes with a specific property in the SICF transaction, though this also disables SAP GUI for HTML and is not viable for all customers. There is no evidence of exploitation in the wild yet. Modat Magnify Query: product="SAP NetWeaver" The platform: https://magnify.modat.io/ Reference: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2026.html #Modat #ModatMagnify #threatintel #vulnerability #CVE202644747 #SAP #NetWeaver #ABAP #infosec #Critical
Post summary
SAP has released a patch for CVE‑2026‑44747, a critical out‑of‑bounds write vulnerability in SAP NetWeaver AS ABAP, and provides both the official patch and a temporary workaround, with no reported exploitation yet.
02040565
1.8K followersView on X
にゃん☆たく/takumi.a@taku888infinity90d
Patch
今日のパッチチューズデー（MS一旦割愛） ◆Ivanti（クリティカルなし） CVE-2026-14903　Xtractionのパストラバーサルで任意ファイル読取 https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-CVE-2026-14902-CVE-2026-14903?l… ◆Fortinet（クリティカルなし） CVE-2025-53379　FortiAuthenticator GUIの境界外読取り CVE-2026-59835　FortiSandboxのVNC無認証アクセス https://www.fortiguard.com/psirt?filter=1&version=&severity=5&severity=4&severity=3&severity=2 ◆SAP CVE-2026-44747　NetWeaver ABAPのメモリ破損で任意コード実行恐れ CVE-2026-27690　SAP ApprouterのHTTPリクエストスマグリング CVE-2026-44761　Commerce Cloudのサンプル認証情報が残存 CVE-2026-40128　NetWeaver Javaのディレクトリトラバーサル https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2026.html ◆Adobe（今日多すぎ） Adobe ColdFusion（APSB26-82） CVE-2026-48318：パストラバーサルによる任意コード実行 CVE-2026-48322：コードインジェクションによる任意コード実行 CVE-2026-48284：入力検証不備による任意コード実行 CVE-2026-48321：認可不備による権限昇格 CVE-2026-48325：認証不備による任意コード実行 CVE-2026-48319：パストラバーサルによる任意コード実行 CVE-2026-48324：SQLインジェクションによる任意コード実行 CVE-2026-48327：認可不備による任意コード実行 CVE-2026-48320：反射型XSSによる権限昇格 CVE-2026-48328：入力検証不備による保護機能回避 CVE-2026-48332：SSRFによる保護機能回避 CVE-2026-48338：パストラバーサルによる任意ファイル読取 Adobe Commerce（APSB26-73） CVE-2026-48356：危険ファイルアップロードによる権限昇格 CVE-2026-48358：出力処理不備による任意コード実行 CVE-2026-47994：格納型XSSによる権限昇格 CVE-2026-47988：認可不備による保護機能回避 CVE-2026-47984：認可不備による保護機能回避 CVE-2026-47995：B2B機能の格納型XSSによる権限昇格 CVE-2026-47996：認可不備による保護機能回避 CVE-2026-47992：入力検証不備による権限昇格 Adobe Experience Manager（APSB26-74） CVE-2026-48259：SSRFによる任意コード実行 CVE-2026-48359：XXEによる任意コード実行 CVE-2026-48252：認証不備による保護機能回避 CVE-2026-48310：パストラバーサルによる任意読取 https://helpx.adobe.com/security.html
Post summary
The post provides a list of newly released patches for multiple CVEs across various vendors, detailing each vulnerability’s nature and linking to official advisories, but it does not mention PoC code or active exploitation.
000421.6K
11.8K followersView on X
CERT-PY@CERTpy82d
General
⚠️ Vulnerabilidades en productos SAP ❗ CVE-2026-44761 ❗ CVE-2026-44747 ❗ CVE-2026-27690 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-sap-8/ https://t.co/6Fnqu3t1hg
Post summary
The tweet lists three SAP product CVEs and provides a link for further information, but gives no details on exploitation, patches, or technical characteristics.
01001272
6.7K followersView on X
CyberTLDR@CyberTLDR90d
Disclosure
2/3: CVE-2026-44747 is an out-of-bounds write. Logical errors in ABAP memory management let an attacker trigger corruption for unauthorized data access or downtime. A CVSS 9.1 HTTP request smuggling bug, CVE-2026-27690, hits SAP Approuter too. #CyberSecurity #CVE #InfoSec
Post summary
The post announces two high‑severity CVEs, providing technical details on an out‑of‑bounds write and an HTTP request smuggling bug, with no mention of PoC, exploitation, or patches.
1000046
26 followersView on X
Orizon@OrizonCyber91d
Patch
🚨 CVE-2026-27690 — CVSS 9.1/10 █████████░ Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/PPv96p3CKO
Post summary
The tweet announces a critical HTTP Request Smuggling vulnerability (CVE-2026-27690) in SAP Approuter with a CVSS score of 9.1/10, and urges users to apply the patch immediately.
1000085
66 followersView on X
IntegSec@integ_sec65d
Patch
CVE-2026-27690: SAP Approuter HTTP Request Smuggling - What It Means for Your Business and How to Respond https://hubs.li/Q04slCvk0
Post summary
The article focuses on CVE-2026-27690, detailing its HTTP request smuggling nature in SAP Approuter and offering guidance on how businesses can respond, though explicit patch or workaround details are not provided in the snippet.
0000046
32 followersView on X
セキュリティ対策Lab@securityLab_jp89d
Patch
SAP、2026年7月のセキュリティパッチデーでCVSS 9.9のNetWeaver重大脆弱性を含む16件を修正(CVE-2026-44747, CVE-2026-27690) https://rocket-boys.co.jp/security-measures-lab/sap-security-patch-day-july-2026-cve-2026-44747/ #セキュリティ対策Lab #security #securitynews
Post summary
The post announces SAP’s July 2026 Patch Day where 16 issues, including a CVSS 9.9 NetWeaver critical vulnerability (CVE‑2026‑44747, CVE‑2026‑27690), are fixed.
00000161
483 followersView on X
TECHEPAGES@techepages90d
Patch
🚨 SAP patches a critical CVSS 9.9 flaw in NetWeaver ABAP that could expose or modify data — plus two more 9.1 criticals 🔹 CVE-2026-44747: out-of-bounds write in NetWeaver ABAP enabling data theft, tampering, or downtime 🔹 CVE-2026-27690: HTTP request smuggling in SAP Approuter exposes user responses & triggers DoS 🔹 CVE-2026-44761: default OAuth credentials in Commerce Cloud let attackers read & modify data 🔹 No in-the-wild exploitation yet — but patch now and audit for the sample OAuth client
Post summary
SAP announces patches for three high‑severity CVEs (CVE‑2026‑44747, CVE‑2026‑27690, CVE‑2026‑44761) with no reports of active exploitation and urges immediate patching and auditing.
0000059
23 followersView on X
TECHEPAGES@techepages91d
Patch
🚨 SAP's July 2026 Patch Day fixes 16 new security issues, led by a critical memory corruption flaw in NetWeaver AS ABAP (CVE-2026-44747, CVSS 9.9) affecting kernel versions 7.22 through 9.20 — both legacy and current deployments. ⚠️ A second critical bug (CVE-2026-27690, CVSS 9.1) enables HTTP Request Smuggling in SAP Approuter, potentially letting attackers bypass authentication or poison caches across SAP BTP landscapes. 🔹 Insecure sample credentials patched in Commerce Cloud (CVE-2026-44761, CVSS 9.1) 🔹 DLL hijacking in SAProuter on Windows (CVSS 8.4) & Apache Camel flaws in Integration Suite (CVSS 8.8) 🔹 3 earlier notes updated, incl. NetWeaver AS Java directory traversal (CVSS 9.0) 🔹 SAP urges immediate patching via SAP Note 3747367 & Support Portal
Post summary
SAP's July 2026 Patch Day addresses 16 critical security issues, including memory corruption in NetWeaver AS ABAP and HTTP Request Smuggling in SAP Approuter, with patches available via SAP Note 3747367 and the Support Portal.
0000074
21 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	sap	approuter	-	node.js	-

Explore more

Back to dashboard sap CVEs approuter vulnerabilities

What researchers are saying

CVE-2026-27690

Modat[verified]@modat_magnifyPatch

SAP has released a patch for CVE‑2026‑44747, a critical out‑of‑bounds write vulnerability in SAP NetWeaver AS ABAP, and provides both the official patch and a temporary workaround, with no reported exploitation yet.

にゃん☆たく/takumi.a[verified]@taku888infinityPatch

The post provides a list of newly released patches for multiple CVEs across various vendors, detailing each vulnerability’s nature and linking to official advisories, but it does not mention PoC code or active exploitation.

Orizon[verified]@OrizonCyberPatch

The tweet announces a critical HTTP Request Smuggling vulnerability (CVE-2026-27690) in SAP Approuter with a CVSS score of 9.1/10, and urges users to apply the patch immediately.

IntegSec[verified]@integ_secPatch

The article focuses on CVE-2026-27690, detailing its HTTP request smuggling nature in SAP Approuter and offering guidance on how businesses can respond, though explicit patch or workaround details are not provided in the snippet.

セキュリティ対策Lab[verified]@securityLab_jpPatch

The post announces SAP’s July 2026 Patch Day where 16 issues, including a CVSS 9.9 NetWeaver critical vulnerability (CVE‑2026‑44747, CVE‑2026‑27690), are fixed.

TECHEPAGES[verified]@techepagesPatch

SAP announces patches for three high‑severity CVEs (CVE‑2026‑44747, CVE‑2026‑27690, CVE‑2026‑44761) with no reports of active exploitation and urges immediate patching and auditing.

TECHEPAGES[verified]@techepagesPatch

SAP's July 2026 Patch Day addresses 16 critical security issues, including memory corruption in NetWeaver AS ABAP and HTTP Request Smuggling in SAP Approuter, with patches available via SAP Note 3747367 and the Support Portal.

CERT-PY@CERTpyGeneral

The tweet lists three SAP product CVEs and provides a link for further information, but gives no details on exploitation, patches, or technical characteristics.