CVE-2026-66761

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-667637.9SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryp CVE-2026-667644.3Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to CVE-2026-667667.5SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unau CVE-2026-667677.7SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers CVE-2026-667689.0SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-priv CVE-2026-667706.3Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definitio CVE-2026-667716.1SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When anot CVE-2026-667724.3SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative CVE-2026-667735.9A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application,CVE-2026-667743.7SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default CVE-2026-667754.3SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker coul CVE-2026-667765.9SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An