SAP Approuter CVE-2026-66774

Exploitation requires both low user privileges (per the CVE description, contradicting the PR:N CVSS value - this discrepancy is unresolved) and a non-default SAP Approuter configuration. The attack complexity is rated High because triggering the vulnerable code path depends on conditions outside the attacker's control, meaning exploitation cannot be reliably automated or repeated on demand. Exploitation is further limited to availability impact only - no data access or modification is possible. The specific non-default configuration required is not disclosed in public sources; organizations should consult SAP Note 3786038 for details. Standard default deployments of SAP Approuter are stated to be outside the exploitable scope.

The overall risk profile for this vulnerability is low. The CVSS base score of 3.7 reflects a network-accessible but high-complexity attack (AV:N/AC:H) limited to availability impact (A:L) with no confidentiality or integrity consequence. The AC:H rating is meaningful here: exploitation depends on conditions outside the attacker's control, making reliable triggering difficult. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS data was not provided but would be expected to be very low given the narrow impact and high complexity. A key data conflict exists: the CVSS vector specifies PR:N (unauthenticated), while the description explicitly states 'an attacker with low privileges' is required - this discrepancy means the effective attack surface may be narrower than the raw vector implies, and security teams should treat PR:L as the more conservative and likely accurate condition until SAP clarifies. The 'Information Disclosure' tag in the EUVD record also conflicts with the CVSS impact of C:N - this tag appears to be erroneous or metadata noise and should not influence triage. Even a mid-sized enterprise running SAP BTP workloads should treat this as a low-urgency patch within a normal maintenance window rather than an emergency remediation, given the non-default configuration requirement and limited blast radius.

A low-privileged network attacker, operating against a non-default SAP Approuter deployment, crafts requests or triggers error conditions designed to expose the improper error-handling path in the node.js routing layer. Successful exploitation would require the attacker to wait for or induce specific external conditions outside their control, making reliable exploitation opportunistic rather than deterministic. The result is a partial degradation of Approuter availability - likely a process crash or routing failure - with no access to underlying data.