AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SAPCVE-2026-66761

SAP Business AI Platform (Approuter): resource exhaustion

SAP

CVE-2026-66761 · Published Aug 11, 2026 · updated Sep 8, 2026

Medium4.3
No fix yet
SAP advisory

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.

Affected versions

PackageAffectedFixed in
SAP Business AI Platform (Approuter)
Product
<= SAP Approuter node.js package < 23.0.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-770

More SAP advisories

All SAP
Critical 10.0Aug 11SAP Commerce Cloud (Data Hub Adapter): remote code executionCVE-2026-58231no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): improper signature checkCVE-2026-66776no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): path traversalCVE-2026-66777no fix yetMedium 5.3Aug 11SAP Approuter does not sufficiently sanitize certain request headers before...CVE-2026-66778no fix yetMedium 6.3Aug 11SAP NetWeaver Application Server ABAP: cross-site scriptingCVE-2026-66779no fix yetHigh 7.9Aug 11SAP BusinessObjects Business Intelligence Platform (Central : hard-coded keyCVE-2026-66763no fix yet