CVE-2026-66761

Executive Summary

CVE-2026-66761 is an unpatched denial-of-service vulnerability in the SAP Approuter component. The component fails to enforce sufficient flow control in certain functionality, allowing a low-privileged network attacker to send high volumes of data without consuming the corresponding responses, which leads to unbounded memory growth and a low impact on availability. No impact to confidentiality or integrity is reported, and no public exploit, PoC, or vendor patch has been identified as of this writing.

Technical Analysis

The vulnerability is rooted in a resource-management flaw classified under CWE-770, "Allocation of Resources Without Limits or Throttling." The affected component, SAP Approuter, is a network-facing routing layer used to mediate traffic between clients and backend applications on SAP platforms. In normal operation, the router receives requests from clients and relays responses back. When a client intentionally stops reading responses while continuing to send data, the router must buffer the outstanding data in memory. Without adequate flow control or an upper bound on buffering, each connection can accumulate an arbitrarily large amount of un-comsumed data.

The NVD description explicitly states that the router "does not enforce sufficient flow control in certain functionality" and that "high volumes of data" can be pushed by an attacker "without consuming responses," causing "unbounded memory growth." This is a classic resource-exhaustion pattern: individual requests may be benign, but the aggregate memory footprint across many connections grows linearly with the volume of unconsumed data until the Node.js process is starved of memory. The CVSS vector confirms the attack is network-reachable (AV:N), requires low attack complexity (AC:L), requires low privileges (PR:L), needs no user interaction (UI:N), and has an unchanged security scope (S:U), meaning the memory pressure is confined to the Approuter component itself rather than crossing into adjacent security boundaries.

The specific code path, function names, or configuration parameters responsible for the missing flow control are not disclosed in the available data. The description refers only to "certain functionality," so precise identification of the vulnerable routine is not possible from public information. Analysts should treat any request-handling path within SAP Approuter that performs synchronous buffering or queuing of response/request payloads as a candidate attack surface. No affected version range has been published, and the vendor has released no advisory or patch reference, leaving the full scope of affected deployments unconfirmed.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-66761; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance and target identification: An attacker identifies network-exposed SAP Approuter instances. Because Approuter is a routing entry point for SAP-hosted applications, it is commonly reachable over HTTPS on standard web ports. Fingerprinting can be performed using Shodan dorks such as title:"SAP Approuter" or http.title:"AppRouter", or through HTTP banner analysis of the routing layer's response headers. The attacker then establishes that they hold, or can obtain, valid low-privileged credentials for the target environment, as the CVSS vector requires PR:L.

2. Triggering the flaw: Using the low-privileged account, the attacker initiates a high volume of requests to the exposed Approuter functionality. The key action is deliberately not consuming the responses — the client sends data faster than it reads the returned responses, or opens many concurrent sessions that leave responses stalled in the server's send buffer. Because the router lacks sufficient flow control, the un-comsumed data is retained in memory.

3. Payload/execution at the vulnerability-class level: No crafted payload beyond a sustained, high-volume data stream is required. The "payload" is volumetric: a flood of legitimate-looking application-layer requests with large or unbounded request bodies, or a large number of simultaneous connections whose responses are never read. The effect is amplified by concurrency — each stalled connection contributes to the aggregate memory allocation.

4. Post-exploitation impact: Memory consumption grows without bound until the Approuter process exhausts available memory, triggering Out-Of-Memory (OOM) conditions, process restart, or unresponsiveness. This causes an availability degradation of the routing service, denying access to the applications that depend on it. The CVSS subsystem score confirms no confidentiality or integrity impact: the attacker cannot read or modify data, only diminish service availability.

Impact Assessment

The base CVSS score is 4.3 (medium severity) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. The low attack complexity and network reachability make the vulnerability easy to trigger technically, but the low-privilege requirement and the attacker's inability to influence confidentiality or integrity temper the severity. The availability component is rated "Low," meaning the denial-of-service effect is expected to be limited and partial — likely performance degradation, repeated process restarts, or temporary unresponsiveness rather than a permanent failure of the underlying host.

The blast radius is functionally contained to the SAP Approuter component (scope unchanged). However, because Approuter is a central routing entry point, even a temporary outage can disrupt access to all downstream applications routed through it, potentially affecting business workflows that depend on the SAP environment. The EPSS score of 0.00220 (12.9th percentile) indicates a low estimated probability of exploitation in the wild, and the CVE is not listed on the CISA Known Exploited Vulnerabilities catalog, with no evidence of active threat actor campaigns. The primary risk factors are the absence of a vendor patch and the unknown affected-version scope, which complicate defensive prioritization.

Detection Guidance

Because CVE-2026-66761 is a volumetric resource-exhaustion flaw rather than a signature-based exploit, deterministic detection is not possible. The rules below are heuristic detections built around three observable signals: (1) a single source generating an abnormally high number of HTTP requests to the Approuter, (2) connections that send data without completing response consumption, and (3) anomalous memory growth on the Approuter host. Field names in the rules are based on common web-access log and network telemetry conventions; adapt them to the naming schema of your specific log collectors.

Sigma Rule

title: SAP Approuter - Sustained High HTTP Request Volume from Single Source
id: c1853a9e-7f7c-4c24-9d3e-3b6f5a1c2d01
status: experimental
description: >
  Detects a single source IP generating an unusually high volume of HTTP requests
  to SAP Approuter within a short time window, consistent with the unbounded
  memory-growth pattern of CVE-2026-66761.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-66761
tags:
  - attack.t1499
  - attack.t1499.003
  - cve.2026.66761
logsource:
  category: webserver
  product: sap
detection:
  selection:
    cs-method:
      - GET
      - POST
      - PUT
  condition: selection | count() by c-ip > 500 within 5m
falsepositives:
  - Legitimate load-testing or health-check automation
  - High-traffic API consumers with valid low-privilege accounts
level: medium

YARA Rule

rule CVE_2026_66761_SAP_Approuter_Unbounded_Requests
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Heuristic YARA rule for CVE-2026-66761: flags packet captures, access logs, or process memory dumps containing an abnormally high density of HTTP request headers consistent with a request-flood pattern against SAP Approuter."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-66761"
        cve = "CVE-2026-66761"
        date = "2026-01-01"
    strings:
        $http_req = /(?:GET|POST|PUT|HEAD) [^\r\n]{0,2048} HTTP\/1\.[01]\r\n/
        $http_hdr = /[A-Za-z0-9-]+: [^\r\n]{0,1024}\r\n/
    condition:
        (#http_req >= 100 and #http_hdr >= 100) or #http_req >= 500
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-66761 SAP Approuter memory-exhaustion flood attempt"; flow:to_server,established; content:"GET"; http.method; threshold: type both, track by_src, seconds 60, count 500; classtype:attempted-dos; reference:cve,CVE-2026-66761; sid:42006661; rev:1;)

This rule raises an alert when a single source IP sends 500 or more HTTP GET requests to the protected network within 60 seconds. Adjust the threshold to match normal baseline traffic for your environment; the rule is intended to catch the sustained, high-volume request pattern that drives unbounded memory growth rather than a single malicious packet.

Elastic Detection

// Detects 4 or more HTTP network events from the same source IP within 5 minutes.
// Tune the number of events and the maxspan window based on baseline traffic.
sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and event.category == "network" ]
  [ network where network.protocol == "http" and event.category == "network" ]
  [ network where network.protocol == "http" and event.category == "network" ]
  [ network where network.protocol == "http" and event.category == "network" ]

For host-level visibility, combine the network sequence with a separate correlation on system metrics: monitor the Approuter host's process.memory.usage or system.memory.actual.used for a sustained upward trend without a corresponding increase in completed response throughput.

Splunk SPL Query

index=web sourcetype=access_combined earliest=-15m latest=now
| bin _time span=1m
| stats count AS req_count BY src_ip, _time
| where req_count > 500
| table _time src_ip req_count
| sort - req_count

Supplement the access-log query with a host-level memory check to correlate flooding with the actual availability impact:

index=os sourcetype=ps earliest=-15m latest=now
| stats max(mem_usage_pct) AS peak_mem_pct BY host
| where peak_mem_pct > 85
| table host peak_mem_pct

Wazuh OSSEC Rule

<group name="sap_approuter,">
  <rule id="100667" level="10" frequency="300" timeframe="60" ignore="30">
    <decoded_as>apache-access</decoded_as>
    <field name="srcip" type="ip">.</field>
    <description>CVE-2026-66761: High volume of HTTP requests to SAP Approuter from a single source (possible memory-exhaustion denial of service).</description>
    <group>dos,</group>
  </rule>
</group>

The rule triggers when 300 or more Apache-style access-log events from the same source IP are decoded within 60 seconds. Tailor the frequency value to your baseline request volume to reduce false positives from legitimate high-traffic consumers.

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence from any tracked source, no vendor fix, and no workarounds have been published by SAP as of this report.

1. Immediate mitigations: Place SAP Approuter behind a reverse proxy or web application firewall (WAF) that enforces per-client request-rate limiting, connection concurrency limits, and maximum request-body sizes. Configure network-level idle timeouts and response-buffer limits on the load balancer or proxy in front of Approuter to prevent clients from stalling response consumption indefinitely. Limit the number of concurrent connections per source IP at the firewall layer. Enable memory-monitoring alerts on Approuter hosts, with thresholds that trigger automated process restart before an OOM crash affects availability.

2. Patch/upgrade steps: No official patch or patched version is currently available. Monitor SAP One Support Launchpad and the SAP Security Patch Day announcements for an OSS note or hotfix referencing CVE-2026-66761. Until a fix is released, treat any known Approuter version as potentially vulnerable.

3. Long-term hardening: Enforce least privilege for application accounts to reduce the pool of low-privileged users who can reach the vulnerable functionality. Periodically review and remove stale accounts, since the CVSS vector requires valid low-privilege credentials. Maintain up-to-date inventory of all internet-exposed Approuter instances and route them through a centralized egress/ingress control point. Re-evaluate the resource limits and flow-control settings of the runtime environment supporting Approuter, and test the environment's resilience to sustained high-volume traffic as part of regular denial-of-service preparedness exercises.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-66761
2. MITRE CVE Record — https://www.cve.org/CVERecord?id=CVE-2026-66761
3. MITRE CWE-770 — https://cwe.mitre.org/data/definitions/770.html
4. FIRST EPSS — https://www.first.org/epss/
5. SAP Support Portal (monitor for pending vendor advisory) — https://support.sap.com
6. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (NOTE: CVE-2026-66761 is not listed; no known exploitation in the wild as of this report.)