SAP Approuter CVE-2026-66760

Exploitation requires all of the following conditions simultaneously: (1) the attacker holds low-privilege access (PR:L) to reach the Approuter network endpoint; (2) the attacker possesses a valid certificate issued by the same trusted certificate authority that Approuter trusts for internal component authentication; (3) that certificate's subject values match those expected for the impersonated trusted internal component - this is the primary complexity barrier (AC:H); and (4) the targeted request traverses a callback flow within Approuter's processing pipeline where the flawed validation logic applies. Exploitation is limited to environments running SAP Approuter node.js package versions below 23.0.0 with certificate-based mutual authentication active in callback flows. Scope is unchanged (S:U), so exploitation impact is confined to the Approuter component and the resources it proxies, not other systems.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L) accurately reflects the threat profile: network-reachable but requiring low privilege and high attack complexity, with high integrity and low confidentiality and availability impacts. The AC:H rating is the key risk limiter - the attacker must independently obtain a certificate from the same trusted CA with subject values matching a trusted internal component, which is non-trivial outside of misconfigured PKI environments or insider access scenarios. No EPSS data was provided in the source intelligence, and the vulnerability is not listed in the CISA KEV catalog, consistent with no confirmed active exploitation at time of analysis. The patch is available and well-scoped (upgrade to node.js package 23.0.0), so the remediation path is clear. Overall, this is a genuine risk for organizations using SAP BTP with certificate-based mutual authentication in callback flows, but real-world exploitability is meaningfully limited by the PKI prerequisites.

An attacker with low-level platform access obtains a certificate issued by the same trusted CA used by SAP Approuter to authenticate internal components, with subject fields crafted or coincidentally matching those of a trusted service. The attacker directs a request through a callback flow in Approuter, presenting this certificate as the client credential. Approuter's incomplete identity validation accepts the certificate as belonging to the impersonated internal component, granting the attacker that component's access rights. No public exploit code exists at time of analysis.