SAP Approuter CVE-2026-66776

Exploitation requires the attacker to hold at least a low-privilege authenticated account on the SAP Business AI Platform Approuter instance, as confirmed by PR:L in the CVSS vector - unauthenticated external access is not sufficient. The critical additional prerequisite is prior out-of-band observation of the target user's matching session values before crafting the bypass request; this is the AC:H constraint and the primary factor limiting exploitation to targeted, deliberate attacks rather than opportunistic scanning. The Approuter must be network-accessible (AV:N), which is its normal deployment posture. The vulnerability is triggered only under 'specific conditions' per the description, meaning not all request types or header combinations reach the vulnerable code path - the exact triggering condition is not specified in available vendor documentation beyond the JWT/session-header context from the tags. Exploitation is limited by: the requirement for a valid low-privilege credential, the need for prior session value acquisition through a separate channel, and the conditional nature of the vulnerable code path.

The CVSS 5.9 (Medium) vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N accurately reflects a genuinely constrained threat: the AC:H rating is substantive here, not nominal, because exploitation requires prior out-of-band acquisition of a target user's session values before any bypass attempt - an attacker cannot simply scan and exploit at scale. EPSS data was not provided in this intelligence package, so automated exploitation probability cannot be quantitatively benchmarked. No CISA KEV listing and no public exploit code were identified, keeping the immediate threat level moderate despite the high confidentiality impact ceiling. Even a mid-sized municipal IT team in inowroclaw running SAP Business AI Platform should treat this as an urgent patch-cycle priority, however, because the network attack vector and lack of user interaction requirement mean a determined insider or compromised low-privilege account could silently load executive-level session contexts without alerting the victim. The combination of no availability impact and scoped damage (S:U) means this is a targeted espionage-class risk rather than a service-disruption threat.

An authenticated low-privilege user on the SAP Business AI Platform monitors application traffic or leverages insider knowledge to obtain session-related header values belonging to a higher-privileged target user. The attacker then sends a specially crafted HTTP request with manipulated session headers to the Approuter, triggering the inconsistent code path that skips integrity verification and causes the system to load the victim's session context as if it were the attacker's own. The attacker gains transparent read access to the victim's session data and any resources bound to that session, with no public exploit code identified at time of analysis.