CVE-2026-66760: SAP Approuter Auth Bypass Vulnerability

CVE-2026-66760 Overview

CVE-2026-66760 affects SAP Approuter, which fails to correctly validate client certificates during certain callback flows. An attacker holding a certificate issued by the same trusted authority with matching subject values can bypass the identity check. Successful exploitation allows impersonation of a trusted internal component. The flaw maps to [CWE-295] Improper Certificate Validation.

The attack requires low privileges and no user interaction, but the high attack complexity makes reliable exploitation difficult. Impact concentrates on integrity, with lower impact to confidentiality and availability.

Critical Impact
An attacker with a certificate from the same trusted CA and matching subject fields can impersonate a trusted internal component, compromising the integrity of communications routed through SAP Approuter.

Affected Products

SAP Approuter (callback flow certificate validation logic)
Applications relying on SAP Approuter for mutual TLS client authentication
Downstream services that trust identities asserted by SAP Approuter

Discovery Timeline

2026-08-11 - CVE-2026-66760 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-66760

Vulnerability Analysis

SAP Approuter acts as a reverse proxy that forwards HTTP requests from end users to backend services and handles authentication callbacks. In certain callback flows, the component checks that a client certificate is issued by a trusted certificate authority and that its subject matches expected values, but does not enforce a sufficiently strict identity binding.

An attacker who legitimately holds a certificate from the same trusted authority, and who can obtain or influence subject field values that match those of a trusted internal caller, can present that certificate during a callback. The Approuter accepts the certificate as belonging to a trusted internal component. The attacker then issues requests as that impersonated identity, altering data or triggering privileged callback logic. The vulnerability is exploitable over the network and requires low privileges, but high attack complexity reflects the need to obtain a suitable certificate.

Root Cause

The root cause is improper certificate validation [CWE-295] in the callback authentication path. Approuter relies on CA trust and subject matching without additionally binding the certificate to a specific expected identity, such as a fingerprint pin, a dedicated internal CA, or a verified caller attribute. Any principal whose certificate satisfies the loose criteria is treated as the trusted component.

Attack Vector

Exploitation proceeds over the network against exposed Approuter callback endpoints. The attacker obtains a certificate from the same trusted authority used to sign legitimate internal component certificates and arranges for the certificate subject to match the values Approuter expects. The attacker then initiates a callback request, presents the certificate during the TLS handshake, and, once accepted, sends requests that Approuter forwards as if originating from a trusted internal component. The advisory does not include public proof-of-concept code; see SAP Note #3786038 for vendor technical details.

Detection Methods for CVE-2026-66760

Indicators of Compromise

Successful client-certificate authentications on Approuter callback endpoints originating from unexpected source IP ranges or geographies.
Multiple distinct client certificates presenting identical or near-identical subject values within a short window.
Callback requests asserting a trusted internal identity outside of normal application traffic patterns or maintenance windows.

Detection Strategies

Enable verbose TLS and mutual-authentication logging on SAP Approuter to capture certificate fingerprints, serial numbers, and subject fields for every callback.
Baseline the fingerprints and serials of legitimate internal component certificates, then alert on any accepted certificate outside that allow-list.
Correlate Approuter access logs with backend service logs to detect callback-initiated actions that do not match a preceding legitimate user flow.

Monitoring Recommendations

Forward Approuter and reverse-proxy logs to a centralized SIEM or data lake for retention and cross-source correlation.
Alert on new or unusual certificate issuers, subjects, or serials observed on callback routes.
Monitor changes to Approuter route configuration and trust store contents, and review them against approved change tickets.

How to Mitigate CVE-2026-66760

Immediate Actions Required

Apply the fix referenced in SAP Note #3786038 on all SAP Approuter instances.
Review the trust store used by Approuter and remove any certificate authorities not required for internal component authentication.
Rotate certificates for trusted internal components and constrain their subject fields to values that are not attainable by external principals.

Patch Information

SAP has published corrective guidance in SAP Note #3786038, released as part of the SAP Security Patch Day Update. Administrators should apply the referenced Approuter update and follow the note's configuration guidance to enforce stricter identity binding on callback flows.

Workarounds

Restrict Approuter callback endpoints at the network layer to source addresses used by legitimate internal components.
Where supported, pin trusted internal component identities by certificate fingerprint or serial number rather than by subject match alone.
Issue internal component certificates from a dedicated private CA that is not used for any external or shared trust purposes.

bash

# Configuration example: restrict callback path to internal networks (nginx front of Approuter)
location /callback/ {
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    deny  all;
    proxy_ssl_verify on;
    proxy_ssl_trusted_certificate /etc/ssl/internal-ca.pem;
    proxy_pass https://approuter.internal;
}