CVE-2026-66761

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3786038	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP Approuter no aplica un control de flujo suficiente en cierta funcionalidad. Un atacante con privilegios bajos podría enviar grandes volúmenes de datos sin consumir respuestas, causando un crecimiento descontrolado de la memoria. Esto resulta en un impacto bajo en la disponibilidad. No hay impacto en la confidencialidad y la integridad.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-66761

Mitre link : CVE-2026-66761

CVE.ORG link : CVE-2026-66761

JSON object : View

Products Affected

sap

approuter

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-66761", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66761", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:17:13.678539Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Business AI Platform (Approuter)", "versions": [{"status": "affected", "version": "SAP Approuter node.js package < 23.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:22.880", "references": [{"url": "https://me.sap.com/notes/3786038", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity."}, {"lang": "es", "value": "SAP Approuter no aplica un control de flujo suficiente en cierta funcionalidad. Un atacante con privilegios bajos podr\u00eda enviar grandes vol\u00famenes de datos sin consumir respuestas, causando un crecimiento descontrolado de la memoria. Esto resulta en un impacto bajo en la disponibilidad. No hay impacto en la confidencialidad y la integridad."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BC1312BC-17DB-45F4-864B-606D46FFFDEE", "versionEndExcluding": "23.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}