SAP Approuter CVE-2026-27690

No authentication, user interaction, or special privileges are required (PR:N/UI:N), and the attack is network-reachable at low complexity (AV:N/AC:L) against an internet-exposed SAP Approuter instance. The core prerequisite is that the Approuter fronts one or more backend services over reused HTTP connections so that a smuggled request can desynchronize the request-response queue; the confidentiality impact (capturing another user's response) is realized only when concurrent legitimate traffic is flowing through the same proxy. Exploitation is limited by network reachability of the Approuter endpoint and by any front-end device that strictly normalizes ambiguous HTTP framing, which would neutralize the smuggling vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) indicates a genuinely serious, network-reachable, low-complexity, unauthenticated issue with high confidentiality and availability impact and no integrity impact - consistent with response-queue poisoning (leaking responses) and connection-pool disruption (unavailability). No EPSS score, KEV entry, POC, or SSVC decision data was provided, so probabilistic and real-world-exploitation signals are absent rather than low; this means the 9.1 rests on intrinsic severity alone. Request smuggling against a widely-used proxy layer is historically attractive to attackers once technical details circulate, so this warrants prompt patching despite the lack of a confirmed public exploit. Note the scope is Unchanged (S:U) even though smuggling can affect other users' sessions - a defensible NVD/vendor choice, but defenders should treat cross-user response exposure as a meaningful confidentiality breach regardless of the scope metric.

An attacker on the internet sends a single crafted HTTP request to a public SAP Approuter endpoint containing ambiguous length/encoding headers so that the proxy and backend disagree on message boundaries. The smuggled portion poisons the shared connection, causing a subsequent legitimate user's response (potentially containing session or personal data) to be delivered to the attacker, and repeated abuse desynchronizes connections enough to make the application unavailable. No authentication or user interaction is required, and no public POC is currently identified.