CVE-2026-66774: SAP Approuter DOS Vulnerability

CVE-2026-66774 Overview

CVE-2026-66774 affects SAP Approuter, a component that routes HTTP requests to backend services in SAP Business Technology Platform environments. The vulnerability stems from inconsistent handling of certain error conditions. An attacker with low privileges could exploit this issue under a non-default configuration. Successful exploitation is highly complex and depends on conditions outside the attacker's control. Impact is limited to availability, with no effect on confidentiality or integrity. This weakness is classified as improper check for unusual or exceptional conditions [CWE-754].

Critical Impact
Successful exploitation could cause a limited availability impact on SAP Approuter under specific non-default configurations. Confidentiality and integrity are not affected.

Affected Products

SAP Approuter (component of SAP Business Technology Platform)
Non-default configurations of SAP Approuter as described in SAP Note #3786038
Refer to the vendor advisory for specific affected versions

Discovery Timeline

2026-08-11 - CVE-2026-66774 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-66774

Vulnerability Analysis

SAP Approuter fails to consistently handle certain error conditions during request processing. When these conditions are triggered, the component may enter an unexpected state that degrades service availability. The issue is exposed only under a non-default configuration, which narrows the population of vulnerable deployments.

Exploitation requires network access and no user interaction, but the attack complexity is high. The attacker must satisfy environmental preconditions that are not directly controllable, such as timing, specific route configurations, or upstream service behavior. As a result, reliable exploitation in the wild is unlikely without significant preparation.

EPSS data reports a low probability of exploitation activity for this CVE. No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities listing exists at this time.

Root Cause

The root cause is improper check for unusual or exceptional conditions [CWE-754]. Approuter does not uniformly validate or recover from specific error states in its request handling logic. When those error states occur, the process reaches an inconsistent condition that affects service continuity.

Attack Vector

The attack vector is network-based. An unauthenticated or low-privileged attacker sends crafted requests to the Approuter over its exposed HTTP interface. To succeed, the attacker must trigger the specific error path in a system running a non-default configuration.

The vulnerability manifests in error-handling logic rather than in a specific parseable input, so no verified proof-of-concept code is available. See SAP Note #3786038 for vendor-provided technical details.

Detection Methods for CVE-2026-66774

Indicators of Compromise

Unexpected restarts, crashes, or unresponsive states in SAP Approuter processes
Spikes in HTTP 5xx responses from Approuter-fronted routes
Error log entries corresponding to unhandled exceptions in request routing
Loss of connectivity between Approuter and backend services without a corresponding backend outage

Detection Strategies

Review Approuter logs for repeated error conditions preceding availability degradation
Correlate HTTP error response spikes with authentication and source IP telemetry
Baseline Approuter process uptime and alert on abnormal restart patterns
Compare running Approuter configuration against SAP-recommended defaults

Monitoring Recommendations

Ingest Approuter application logs and access logs into a centralized log platform
Monitor process health, memory, and CPU metrics for the Approuter service
Alert on sustained increases in request latency or upstream connection failures
Track configuration drift for xs-app.json and environment variables used by Approuter

How to Mitigate CVE-2026-66774

Immediate Actions Required

Apply the fix referenced in SAP Note #3786038 on the next available maintenance window
Review Approuter configurations and align them with SAP-recommended defaults where possible
Restrict network exposure of Approuter to trusted networks and reverse proxies
Ensure health checks and automatic restart policies are in place for the Approuter process

Patch Information

SAP has published remediation guidance through SAP Note #3786038. Additional context is available via the SAP Security Patch Day Information page. Customers should authenticate to the SAP Support Portal to retrieve the applicable patch and version details for their landscape.

Workarounds

Revert to a default Approuter configuration if the vulnerable non-default setting is not required
Place a rate-limiting reverse proxy or web application firewall in front of Approuter
Reduce request timeouts and enforce connection limits to contain availability impact
Segment Approuter deployments so a single instance failure does not degrade tenant-wide service

bash

# Configuration example: verify Approuter version and restart policy
npm list @sap/approuter
systemctl status approuter
systemctl enable --now approuter