Medium severity · published Aug 11, 2026
CVE-2026-66761
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP Business AI Platform (Approuter) · SAP_SE
SAP Approuter node.js package < 23.0.0 · source: vendor
AP
Approuter · Sap
before 23.0.0 · source: NVD
Affected product
SB
SAP Business AI Platform (Approuter)
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66761
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66761
Permissions Required
https://me.sap.com/notes/3786038
Vendor Advisory
https://url.sap/sapsecuritypatchday
More from SAP Business AI Platform (Approuter)
7.0
CVE-2026-58230
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
6.4
CVE-2026-66760
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
5.9
CVE-2026-66777
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
5.9
CVE-2026-66776
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
5.9
CVE-2026-58238
Multiple vulnerabilities in SAP Business AI Platform (Approuter)