CVE-2026-66760

SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3786038	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP Approuter no valida correctamente los certificados de cliente en ciertos flujos de devolución de llamada. Un atacante con privilegios bajos, que posee un certificado de la misma autoridad de confianza con valores de asunto coincidentes, podría eludir la verificación de identidad. Esta complejidad hace que el ataque sea difícil de ejecutar. La explotación exitosa podría permitir la suplantación de un componente interno de confianza, lo que resultaría en un alto impacto en la integridad y un bajo impacto en la confidencialidad y la disponibilidad.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-66760

Mitre link : CVE-2026-66760

CVE.ORG link : CVE-2026-66760

JSON object : View

Products Affected

sap

approuter

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-66760", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66760", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:17:27.251606Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 1.6}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Business AI Platform (Approuter)", "versions": [{"status": "affected", "version": "SAP Approuter node.js package < 23.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:22.757", "references": [{"url": "https://me.sap.com/notes/3786038", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability."}, {"lang": "es", "value": "SAP Approuter no valida correctamente los certificados de cliente en ciertos flujos de devoluci\u00f3n de llamada. Un atacante con privilegios bajos, que posee un certificado de la misma autoridad de confianza con valores de asunto coincidentes, podr\u00eda eludir la verificaci\u00f3n de identidad. Esta complejidad hace que el ataque sea dif\u00edcil de ejecutar. La explotaci\u00f3n exitosa podr\u00eda permitir la suplantaci\u00f3n de un componente interno de confianza, lo que resultar\u00eda en un alto impacto en la integridad y un bajo impacto en la confidencialidad y la disponibilidad."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BC1312BC-17DB-45F4-864B-606D46FFFDEE", "versionEndExcluding": "23.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}