CVE-2026-66760

SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability.

• CWE-295

• https://me.sap.com/notes/3786038Permissions Required
• https://url.sap/sapsecuritypatchdayVendor Advisory

Published

Aug 11, 2026

Last Modified

Sep 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66755Relative Path Traversal in the ISA-Tab parser in Apache Soft…7.5
• CVE-2026-66756Improper Protection of Alternate Path vulnerability in Apach…9.8
• CVE-2026-66757A flaw was found in the file-sgi plugin in GIMP. When proces…5.5
• CVE-2026-66758A flaw was found in the file-fits plugin in GIMP. When proce…7.8
• CVE-2026-66759A flaw was found in the file-icns plugin in GIMP. When apply…7.1
• CVE-2026-6676Heap buffer out-of-bounds write vulnerability in Avira Antiv…7.8
• CVE-2026-66761SAP Approuter does not enforce sufficient flow control in ce…4.3
• CVE-2026-66763SAP BusinessObjects Business Intelligence Platform stores ce…7.9
• CVE-2026-66764Reprocess Bank Statement Items in SAP S/4HANA does not perfo…4.3
• CVE-2026-66766SAP S/4HANA (Private Cloud) uses a third-party component tha…7.5
• CVE-2026-66767SAP NetWeaver Application Server for ABAP and ABAP Platform …7.7
• CVE-2026-66768SAP GUI for Java does not correctly enforce the trust level …9