CVE-2026-27690

critical · 9.1

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

9.1

CVSS

0.7%

EPSS (exploit prob.)

51st

EPSS percentile

2026-07-14

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weaknesses

CWE-444

Affected products

Vendor	Product	Affected versions
sap	approuter	< 20.10.0

Check a specific version with /api/v1/cve/match.

References

https://me.sap.com/notes/3720138
https://url.sap/sapsecuritypatchday

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-27690