| CVE ID | Description | CVSS | Priority | Trend | Exploit | Patch |
|---|---|---|---|---|---|---|
| CVE ID | Description | CVSS | Priority | Trend | Exploit | Patch |
|---|---|---|---|---|---|---|
Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
Known vulnerabilities affecting Sap products and systems
| CVE ID | Description | CVSS | Priority | Trend | Exploit | Patch |
|---|---|---|---|---|---|---|
| CVE-2026-66778 | SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limi... | 5.3 | 124 | Neutral | No |
| Yes |
| CVE-2026-66777 | SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges... | 5.9 | 271 | Neutral | No | Yes |
| CVE-2026-66776 | SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted ... | 5.9 | 148 | Neutral | No | Yes |
| CVE-2026-66775 | SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following i... | 4.3 | 163 | Neutral | No | Yes |
| CVE-2026-66774 | SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as... | 3.7 | 102 | Neutral | No | Yes |
| CVE-2026-66761 | SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory g... | 4.3 | 99 | Neutral | No | Yes |
| CVE-2026-66760 | SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject va... | 6.4 | 196 | Neutral | No | Yes |
| CVE-2026-58239 | SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not full... | 3.7 | 102 | Neutral | No | Yes |
| CVE-2026-58238 | SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Su... | 5.9 | 155 | Neutral | No | Yes |
| CVE-2026-58237 | WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful ... | 5.9 | 213 | Neutral | No | Yes |
| CVE-2026-58230 | SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential materia... | 7.0 | 337 | Neutral | No | Yes |
| CVE-2026-46555 | WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.... | 7.1 | 305 | Neutral | No | Yes |
| CVE-2026-44745 | SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link wh... | 8.1 | 519 | Neutral | No | Yes |
| CVE-2026-42009 | GnuTLS versions prior to 3.8.13 are susceptible to vulnerabilities which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of S... | 7.5 | 386 | Neutral | No | Yes |
| CVE-2026-40135 | An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially cr... | 6.5 | 362 | Neutral | No | Yes |
| CVE-2026-34486 | Multiple NetApp products incorporate Apache Tomcat. Apache Tomcat versions 9.0.116, 10.1.53, and 11.0.20 are susceptible to a vulnerability which when successfully exploited could lead to disclosure o... | 7.5 | 616 | Rising | Yes | Yes |
| CVE-2026-34264 | During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the ... | 6.5 | 209 | Neutral | No | Yes |
| CVE-2026-34262 | Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer | 4.3 | 329 | Neutral | Yes | Yes |
| CVE-2026-34257 | Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the pag... | 6.1 | 207 | Neutral | No | Yes |
| CVE-2026-33417 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_resets table includes a created_at timestamp c... | 7.1 | 305 | Neutral | No | Yes |