Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-66776 SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileg… https://www.cve.org/CVERecord?id=CVE-2026-66776
Post summary
The brief notice references CVE-2026-66776, noting that SAP Approuter fails to consistently enforce integrity on some session headers, but provides no PoC, exploit details, or remediation info.
🚨*CVE* CVE-2026-66776 SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileg… https://www.cve.org/CVERecord?id=CVE-2026-66776 ----- Traducción: CVE-2026-66776 SAP… http://infoflow.cloud`
Post summary
A new CVE (CVE-2026-66776) affecting SAP Approuter has been disclosed, highlighting an integrity verification issue on session headers, with no PoC, exploit, patch, or active exploitation information included.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sap | approuter | - | node.js | - |