What is the CVSS score of CVE-2026-27690?

CVE-2026-27690 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of SAP Approuter are affected by CVE-2026-27690?

SAP Approuter contains a critical request-response desynchronization vulnerability (CVE-2026-27690, CVSS 9.1) exploitable by unauthenticated remote attackers to access other users' sensitive data and…. A patch is available.

How to fix or mitigate CVE-2026-27690?

Within 24 hours, audit all SAP Approuter deployments for internet exposure and document current versions in use. Implement network segmentation to block direct external access to Approuter instances where feasible, restricting connectivity to necessary upstream services only. Within 7 days, deploy a Web Application Firewall (WAF) with rules targeting HTTP request smuggling patterns specific to Approuter, and enable comprehensive request and response logging to detect exploitation attempts. Within 30 days, subscribe to SAP security advisories, establish a patch deployment workflow, and conduct regular testing of any released patches in a staging environment. Simultaneously, engage SAP support to confirm which Approuter versions are affected and request vendor-specific hardening recommendations for your deployment architecture.

SAP Approuter CVE-2026-27690

EUVD-2026-43584 CRITICAL

HTTP Request/Response Smuggling (CWE-444)

2026-07-14 sap

GHSA-8m85-wqg7-c529

SAP Request Smuggling Information Disclosure Sap Approuter

9.1

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network request smuggling (AV:N/AC:L/PR:N/UI:N) exposing other users' responses (C:H) and disrupting service (A:H); no data modification, so I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 14, 2026 - 05:17 EUVD

Analysis Generated

Jul 14, 2026 - 01:15 vuln.today

CVE Published

Jul 14, 2026 - 00:17 cve.org

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 npm packages depend on @sap/approuter (3 direct, 1 indirect)

Ecosystem-wide dependent count for version 20.10.0.

DescriptionCVE.org

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

Articles & Coverage 1

News Critical HTTP Request Smuggling in SAP Approuter - CVE-2026-27690 Jul 14, 2026

AnalysisAI

Request-response desynchronization in SAP Approuter lets an unauthenticated remote attacker send a specially crafted HTTP request that smuggles a second request past the front end, allowing exposure of other users' HTTP responses and denial of service against the application. The flaw carries a CVSS 9.1 (high confidentiality and availability impact) and was reported by SAP; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

SAP Approuter is the Node.js-based reverse proxy and routing component that sits in front of SAP Business Technology Platform (BTP) / Cloud Foundry applications, terminating client connections, handling authentication flows, and dispatching requests to backend microservices. The vulnerability is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests, i.e. HTTP Request Smuggling), which occurs when a front-end proxy and a back-end server disagree on where one HTTP message ends and the next begins - typically due to conflicting Content-Length/Transfer-Encoding handling or chunked-encoding parsing differences. Because Approuter multiplexes many users' requests over pooled backend connections, a desynchronized connection can splice one client's request onto another client's response stream. The affected product per CPE is cpe:2.3:a:sap_se:sap_approuter:*:*:*:*:*:*:*:*.

RemediationAI

Apply the fix described in SAP Security Note 3720138 (https://me.sap.com/notes/3720138) and cross-reference the SAP Security Patch Day listing (https://url.sap/sapsecuritypatchday); as Approuter ships as the @sap/approuter npm dependency, upgrade each affected application to the patched Approuter version specified in the note and redeploy. An exact fix version is not included in the provided data, so the patched version must be read from SAP Note 3720138 rather than assumed. If immediate patching is not possible, place a smuggling-aware reverse proxy or WAF in front of Approuter that normalizes/rejects ambiguous requests (e.g. requests carrying both Content-Length and Transfer-Encoding, or malformed chunked encoding), and consider disabling HTTP connection reuse/keep-alive to backends to break the response-queue-poisoning primitive - with the trade-off of increased connection overhead and latency. Restrict exposure of the Approuter endpoint to trusted networks where the deployment model allows.