Loading story…
A critical vulnerability, CVE-2026-27690, has been disclosed in SAP Approuter. The flaw is an HTTP Request Smuggling issue classified as CWE-444 that affects the SAP Approuter node.js package in versions earlier than 20.10.0. SAP said an unauthenticated attacker can send a specially crafted HTTP request to trigger request-response desynchronization, enabling exposure of user responses and causing service unavailability.
The vulnerability carries a CVSS v3.1 score of 9.1 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, indicating remote exploitation without authentication or user interaction. Public CVE records describe the impact as high for confidentiality and availability, making patching to version 20.10.0 or later a priority for organizations using SAP Approuter in internet-facing or proxy-dependent environments.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A CVE record was published for CVE-2026-27690, an HTTP Request Smuggling vulnerability in SAP Approuter affecting node.js package versions earlier than 20.10.0. The issue can be exploited without authentication to cause request-response desynchronization, potentially exposing user responses and causing service unavailability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP disclosed **CVE-2026-58240** (also tracked as S4GET), a critical missing-authentication and trust-validation flaw in SAP NetWeaver Message Server, rated **CVSS 9.8**. An unauthenticated attacker able to reach the Message Server’s public SAP GUI-facing port can send a crafted packet, cause an IP address to be trusted across an SAP cluster, and bypass Gateway trust boundaries. The resulting rogue component registration or trusted-peer impersonation can enable interception, alteration, redirection, or disruption of SAP inter-component traffic and may lead to remote code execution as the SAP operating-system account `<sid>adm`. Affected deployments include SAP NetWeaver Message Server components on kernel versions **9.16, 9.18, 9.19, and 9.20**. SAP issued the definitive remediation in **Security Note 3759472**; organizations should apply it immediately, identify and restrict Message Server public-port exposure—especially Internet exposure—and review cluster and Gateway trust configurations. No confirmed in-the-wild exploitation or CISA KEV listing had been reported at publication, but the public network attack surface and likelihood of rapid weaponization make this a high-priority patching issue.
Sep 9, 2026
SAP has patched a maximum-severity vulnerability in **SAP Commerce Cloud (Data Hub Adapter)**, tracked as `CVE-2026-58231`, that could allow an unauthenticated attacker to achieve arbitrary code execution. The flaw affects `COM_CLOUD 2211` and `2211-JDK21` and stems from improper authorization and insufficient input validation, enabling abuse of a default authentication client and specially crafted input to reach vulnerable functions. The issue is classified as `CWE-94` and carries a `CVSS` score of **10.0**, with potential impact across confidentiality, integrity, and availability. SAP and Onapsis urged customers to upgrade to a fixed Commerce Cloud release and redeploy the updated version, while suggesting IP filtering as a temporary mitigation. SAP's broader August security update also addressed three additional critical flaws affecting **Manufacturing Integration and Intelligence** and **Application Server ABAP for SAP NetWeaver and ABAP Platform**, including code injection and memory corruption bugs that could lead to command execution, information disclosure, or system crashes.
Aug 17, 2026
SAP disclosed **CVE-2026-44747**, a critical memory corruption vulnerability in **SAP NetWeaver Application Server ABAP**, and published remediation guidance in **Security Note `3747367`** as part of its Security Patch Day materials. The flaw is classified as **CWE-787** and affects multiple SAP ABAP kernel releases, including `KRNL64NUC 7.22`, `7.22EXT`, `KRNL64UC 7.22`, `7.53`, `7.54`, `7.77`, `7.89`, `7.93`, and `9.16` through `9.20`. The vulnerability can be exploited remotely by an authenticated attacker with low privileges and carries a **CVSS v3.1 score of 9.1** (`AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`). Successful exploitation could cause unauthorized data access, data modification, privilege escalation, or system unavailability. Public reporting said there was **no confirmed active exploitation** at the time of disclosure, but the impact profile makes patching affected SAP environments a priority.
Jul 23, 2026