What is the CVSS score of CVE-2026-66760?

CVE-2026-66760 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-66760?

Yes, a patch is available for CVE-2026-66760. Update the affected software to the latest version immediately.

SAP Approuter CVE-2026-66760

EUVD-2026-55878 MEDIUM

Improper Certificate Validation (CWE-295)

2026-08-11 sap

GHSA-x986-f697-6r4v

Authentication Bypass SAP Sap Business Ai Platform Approuter Sap Se

6.4

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

vuln.today AI

6.4 MEDIUM

Network-accessible callback flow; AC:H reflects mandatory CA-matching certificate prerequisite; PR:L for required low-privilege access; I:H for component impersonation; S:U as impact stays within Approuter's trust boundary.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 01:09 vuln.today

Patch available

Aug 11, 2026 - 01:02 EUVD

DescriptionCVE.org

SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability.

AnalysisAI

Certificate validation bypass in SAP Approuter node.js package (versions prior to 23.0.0) enables a low-privileged network attacker holding a certificate from the same trusted CA with matching subject values to impersonate trusted internal components during certain callback flows. The attack path is constrained by high complexity - the attacker must satisfy specific PKI prerequisites - but successful exploitation yields high integrity impact through component impersonation. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

SAP Approuter is a node.js reverse proxy package central to SAP Business Technology Platform (BTP) multi-module applications, responsible for routing, authentication, and service-to-service authorization. The affected CPE is cpe:2.3:a:sap_se:sap_business_ai_platform_(approuter):*:*:*:*:*:*:*:* covering all versions below 23.0.0. The root cause is CWE-295 (Improper Certificate Validation): during specific callback flows, Approuter validates that a client certificate was issued by a trusted CA and has matching subject values, but does not perform a sufficiently specific identity binding - for example, failing to uniquely verify the certificate against a registered service instance, SAN field, or internal identifier. This allows an attacker who holds any valid certificate from that CA hierarchy with overlapping subject fields to pass the identity check and be treated as a trusted internal component.

RemediationAI

Upgrade the SAP Approuter node.js package to version 23.0.0 or later, which resolves the improper certificate validation in callback flows. This is the vendor-confirmed fix per SAP Security Note 3786038 (https://me.sap.com/notes/3786038) and SAP Security Patch Day (https://url.sap/sapsecuritypatchday). If immediate patching is not feasible, restrict network access to Approuter callback flow endpoints at the perimeter or service mesh level to explicitly allowlisted trusted service identities only - note this may disrupt legitimate service-to-service communication if not carefully scoped. Additionally, audit the CA trust store configured in Approuter to confirm no unauthorized certificates with overlapping subject fields exist; revoke any suspect certificates. These compensating controls reduce the attack surface but do not eliminate the underlying validation deficiency.