CVE-2026-27690

—

CVSS 3.1

9.1 critical

EPSS

<1%p50

Published

Jul 14, 2026 (Jul 14, 2026)

Modified

Sep 8, 2026

Description

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

Vendors: sap
Products: approuter
Weakness: CWE-444
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news3 stories

⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0

The Hacker NewsJul 21, 04:34 UTC · Jul 21, 2026Vulnerability in the wildCVE-2026-63030 CVE-2026-60137 CVE-2026-15409+26 CVEs

SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data

The Hacker NewsJul 15, 00:00 UTC · Jul 15, 2026Vulnerability in the wildCVE-2026-44747 CVE-2026-27690 CVE-2026-44761

Microsoft discloses ‘the mother of all’ vulnerability loads, tripling June’s previous record

CyberScoopJul 14, 20:05 UTC · Jul 14, 2026Vulnerability in the wildCVE-2026-56155 CVE-2026-56164 CVE-2026-44747+1 CVEs1