CVE-2026-27690

CVE Enrichment

CVSS: 9.1 CRITICAL
EPSS: 0.68%
EPSS Percentile: 52.30%
CISA KEV: Not listed

Description

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 14-Jul-2026 08:16
Last Modified: 25-Oct-2026 05:10
EPSS Date: 2026-10-27
CWE: CWE-444

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:H

Affected Products / Versions

sap / approuter Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 20.10.0
cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*

References

Last enrichment sync: 28-Oct-2026 20:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

#SAPNetWeaver SAP Patches Critical NetWeaver ABAP Flaw and Two Other Vulnerabilities
SAP also addressed a fresh assortment of vulnerabilities Tuesday, including critical defects CVE-2026-44747 in SAP NetWeaver Application Server and CVE-2026-27690 in SAP Approuter. Microsoft patches 622 vulnerabilities, including two exploited zero-days
#SAPNetWeaver SAP patches 16 flaws in July updates, including three critical vulnerabilities

CVE (4)

People (2)

MITRE ATT&CK (2)

Vendors (2)

Products (10)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.