CVE-2026-27690CWE-444

CVE-2026-27690

Critical · published July 14, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00682 · 52.0th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-07-14T05:16Z
Affected products (1)
ProductVersionsFixed in
sap/approuter< 20.10.020.10.0
References (2)
https://me.sap.com/notes/3720138 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 14 JUL 00:17Z
    HTTP Request Smuggling in SAP Approuter
    cvelistv5