SAP Approuter CVE-2026-66777

The attacker must hold low-privilege authenticated access to the SAP BTP tenant or application hosting the Approuter instance, as confirmed by PR:L in the CVSS vector - unauthenticated external actors cannot exploit this vulnerability. Beyond authentication, exploitation requires satisfying high-complexity conditions (AC:H) inherent to the path traversal bypass: the attacker must craft HTTP requests with specific path structures that evade the Approuter's validation logic, which SAP characterizes as non-trivial. The attack is delivered over the network (AV:N) and requires no user interaction (UI:N). Key limiting factors: (1) valid credentials for the target SAP BTP environment are mandatory; (2) the high attack complexity makes automated or mass exploitation unlikely; (3) scope is unchanged (S:U), so impact is limited to resources accessible through the specific Approuter instance; (4) no special non-default Approuter configuration is described as required beyond the attacker having network reach to the Approuter endpoint.

The CVSS 3.1 base score of 5.9 (Medium) is shaped primarily by AC:H, which SAP explicitly attributes to the complexity of conditions required - this substantially reduces the practicality of opportunistic or automated exploitation despite the network attack vector (AV:N). PR:L confirms the attacker must already hold valid authenticated access to the SAP BTP tenant or application, ruling out unauthenticated external threats. C:H reflects genuine risk of sensitive data exposure if exploitation succeeds, while I:L and A:N bound the damage surface. No EPSS score was included in the provided intelligence, preventing probabilistic exploitation likelihood assessment. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no proof-of-concept code has been publicly reported, suggesting this has not been operationalized at scale. Real-world risk is moderate: the primary threat actor profile is a malicious or compromised insider with low-privilege SAP BTP credentials who can invest effort to meet the high-complexity exploitation conditions.

A low-privileged authenticated user of an SAP BTP application - such as a standard business user or a compromised service account - crafts an HTTP request with manipulated path components targeting the SAP Approuter endpoint. By constructing the specific path pattern that satisfies the complex bypass conditions (AC:H), the attacker causes the Approuter to forward the request to a protected backend destination beyond their authorized scope, allowing them to read sensitive business data or perform limited writes to restricted resources. No public proof-of-concept exists at time of analysis, but the attack requires only network access and low-privilege credentials once the bypass conditions are determined.