EUVD-2026-43583
GHSA-3g84-hpr9-w7v5
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
DLL hijacking needs local write access to a searched directory, so AV:L and realistically PR:L; loaded code runs in the service context giving full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.
AnalysisAI
Arbitrary code execution in SAProuter on Microsoft Windows lets a local attacker plant a malicious DLL in an untrusted search-path location that SAProuter loads at runtime, hijacking the DLL loading process to run attacker code with the privileges of the SAProuter service. The flaw was reported by SAP and carries a CVSS 8.4 with full High impact on confidentiality, integrity, and availability; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SAProuter typically runs as a persistent network gateway service, successful exploitation can compromise a strategically positioned host in an SAP landscape.
Technical ContextAI
SAProuter is SAP's application-level proxy/gateway that brokers and filters network connections (SAP protocol/NI) between separated networks, commonly sitting at the edge of an SAP landscape or facilitating SAP support connectivity. The root cause is CWE-427 (Uncontrolled Search Path Element), the classic Windows DLL search-order/DLL-hijacking pattern: when the SAProuter executable resolves a required library by name without a fully qualified, trusted path, Windows will search directories such as the application's working directory or other writable path locations first, so a DLL of the expected name placed there is loaded instead of the legitimate one. The affected component is identified by CPE cpe:2.3:a:sap_se:saprouter_on_microsoft_windows:*, i.e., the Windows build of SAProuter across versions (no fixed version boundary is enumerated in the CPE).
RemediationAI
Apply the fix delivered via SAP Security Note 3692165 (https://me.sap.com/notes/3692165), released through SAP Security Patch Day (https://url.sap/sapsecuritypatchday) - this is a patch available per vendor advisory; the exact fixed version is not stated in the available data, so confirm the target build directly in the SAP note. Until patched, reduce DLL-hijacking exposure by hardening the host: install and run SAProuter from a directory whose ACLs deny write access to non-administrative users, ensure no untrusted or writable directory precedes system directories in the effective DLL search order, remove any stray/unexpected DLLs from the SAProuter working directory, and restrict interactive and local file-write access on the SAProuter host to trusted administrators only. Where supported, enabling safe DLL search mode and running the service under a least-privilege account limits the blast radius; the trade-off is that these are host-hardening controls that do not remove the underlying search-path flaw and require operational validation to avoid disrupting the service.
Same weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today