CVE-2026-66760

Katalog CVE

CVSS 6.4 · Medium EPSS 0,18%

Kerentanan Improper Certificate Validation pada sap approuter. Skor CVSS 3.1 6.4 (Medium) menurut sap.com.

Deskripsi (NVD)

SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Analyzed

CVSS 3.1

6.4 (Medium), sumber sap.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://url.sap/sapsecuritypatchday advisory vendor
• https://me.sap.com/notes/3786038 permissions required