CVE-2026-27690: SAP Approuter Vulnerable to HTTP Request Smuggling

July 14, 2026 (updated September 1, 2026)

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

References

github.com/advisories/GHSA-8m85-wqg7-c529
me.sap.com/notes/3720138
nvd.nist.gov/vuln/detail/CVE-2026-27690
url.sap/sapsecuritypatchday

Code Behaviors & Features

Detect and mitigate CVE-2026-27690 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →