CVE WatchAug 11, 2026

CVE-2026-66776

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An

CVSS

5.9

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Aug 11, 2026 · Last modified: Aug 11, 2026 · CWE-347

EPSS · 30d

Not enough EPSS history yet.

Technical description

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-627575.3 MED

—

———Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network.6h CVE-2026-155568.1 HIG

—

——0A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.7h CVE-2026-105799.8 CRI

—

——0A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.7h CVE-2026-10754—

—

——0Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.12h CVE-2026-59112—

—

——0Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.1d CVE-2026-167426.7 MED

—

——0systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user1d