CVE-2026-27690 — HTTP Request Smuggling in SAP Approuter

CVE-2026-27690

HTTP Request Smuggling in SAP Approuter PUBLISHED

Description (CNA)

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Approuter	affected SAP Approuter node.js package < 20.10.0

CWE

CWE-444

References

https://me.sap.com/notes/3720138
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.