CVE-2026-66776

MediumCVSS 5.9/10Last modified Oct 24, 2026

Description

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-667775.9SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexityCVE-2026-667785.3SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated atCVE-2026-667796.3Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicCVE-2026-66785.3Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.CVE-2026-667806.5A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, posseCVE-2026-667815.4A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPseCVE-2026-667825.8A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer tCVE-2026-667834.4A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cCVE-2026-667858.7A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clustCVE-2026-667869.1A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource DeCVE-2026-667878.7A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficieCVE-2026-667889.9A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namesp
CVE-2026-66776: Medium severity, CVSS 5.9 | Vulnix