CVE-2026-27690 | THREATINT

Description

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

PUBLISHED Reserved 2026-02-23 | Published 2026-07-14 | Updated 2026-07-14 | Assigner sap

CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Problem types

CWE-444: Inconsistent Interpretation of HTTP Requests

Product status

Default status

unaffected

SAP Approuter node.js package < 20.10.0

affected

References

me.sap.com/notes/3720138

url.sap/sapsecuritypatchday

cve.org (CVE-2026-27690)

nvd.nist.gov (CVE-2026-27690)

Download JSON