CVE-2026-0487: SAProuter DLL Hijacking RCE Vulnerability

CVE-2026-0487 Overview

CVE-2026-0487 is a DLL hijacking vulnerability affecting SAProuter running on Microsoft Windows. The flaw allows an unauthenticated attacker to load Dynamic Link Library (DLL) files from an untrusted location. Successful exploitation lets the attacker hijack the DLL loading process and execute arbitrary code on the host system. The weakness is classified under CWE-427: Uncontrolled Search Path Element. Impact spans confidentiality, integrity, and availability of the affected system. The vulnerability requires local access but no privileges or user interaction, making it valuable for attackers who have already established a foothold on a Windows host running SAProuter.

Critical Impact
Attackers who can place a malicious DLL in a location searched by SAProuter can achieve arbitrary code execution with the privileges of the SAProuter process, compromising SAP network routing infrastructure.

Affected Products

SAProuter on Microsoft Windows (see SAP Note 3692165 for affected releases)
SAP environments using SAProuter for network communication routing
Windows hosts where SAProuter is deployed as a gateway or proxy

Discovery Timeline

2026-07-14 - CVE-2026-0487 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-0487

Vulnerability Analysis

SAProuter is an SAP application that acts as a proxy in network connections between SAP systems and clients, typically deployed at the network perimeter. On Microsoft Windows, the process loads library files during startup and runtime to support its routing functionality.

The vulnerability stems from an uncontrolled DLL search path. When SAProuter attempts to load a required DLL, it searches directories in a defined order. If an attacker can place a malicious DLL with a matching name in a directory searched before the legitimate library location, Windows loads the attacker-supplied binary instead. The malicious DLL then executes with the privileges of the SAProuter process.

Exploitation is local, requires no authentication, and no user interaction. It affects confidentiality, integrity, and availability at high severity.

Root Cause

The root cause is improper control of the DLL search path used by SAProuter on Windows. The application does not enforce a fully qualified path or apply Windows library loading protections such as SetDefaultDllDirectories or safe search mode, allowing untrusted directories to be evaluated during library resolution.

Attack Vector

An attacker with local write access to a directory in the SAProuter DLL search order places a crafted DLL using the expected name of a legitimate dependency. When SAProuter starts or reloads, Windows resolves the DLL from the attacker-controlled path and invokes DllMain, executing the payload in the SAProuter process context. Refer to the GitHub PoC for CVE-2026-0487 for the technical walkthrough.

Detection Methods for CVE-2026-0487

Indicators of Compromise

Unexpected DLL files present in the SAProuter working directory or on the process search path
SAProuter process (saprouter.exe) loading modules from non-standard paths such as user-writable directories
Child processes spawned by SAProuter that do not match legitimate operational patterns
File creation events for DLLs immediately preceding SAProuter start or restart

Detection Strategies

Enumerate loaded modules of running SAProuter processes and compare against a known-good baseline of expected DLL paths
Monitor Windows event logs and Sysmon Event ID 7 (Image Loaded) for SAProuter loading unsigned or unexpected libraries
Alert on file writes of .dll files into directories on the SAProuter search path by non-administrative users

Monitoring Recommendations

Deploy behavioral endpoint monitoring on Windows hosts running SAProuter to flag anomalous module loads and process behavior
Ingest Sysmon and Windows Security logs into a central SIEM or data lake for correlation of DLL write and load events
Continuously review integrity of the SAProuter installation directory and any directory writable by non-privileged accounts

How to Mitigate CVE-2026-0487

Immediate Actions Required

Apply the fix documented in SAP Note 3692165 as published on SAP Security Patch Day
Restrict write permissions on the SAProuter installation directory and any directory in its DLL search path to administrators only
Audit Windows hosts running SAProuter for unauthorized DLL files and remove any that are not part of the official distribution
Run SAProuter under a dedicated low-privilege service account to limit blast radius if exploitation occurs

Patch Information

SAP addressed CVE-2026-0487 in the security update referenced by SAP Note 3692165. Administrators must authenticate to the SAP support portal to retrieve the patched SAProuter binaries and follow the installation guidance in the note. Additional context is available through the SAP Security Patch Day portal.

Workarounds

Deploy SAProuter only on hardened Windows hosts with strict file system ACLs preventing untrusted DLL placement
Remove the current working directory and other writable locations from the effective library search order where feasible
Enable Windows application allowlisting (such as AppLocker or WDAC) to block execution of unsigned DLLs from non-standard paths
Isolate SAProuter hosts on segmented networks with restricted interactive logon rights to reduce local access opportunities

bash

# Example: restrict write access on the SAProuter directory (run as Administrator)
icacls "C:\usr\sap\saprouter" /inheritance:r
icacls "C:\usr\sap\saprouter" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "SAProuterSvc:(OI)(CI)RX"
icacls "C:\usr\sap\saprouter" /remove "Users" "Authenticated Users"