{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66761", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-07-27T17:33:40.733Z", "datePublished": "2026-08-11T00:17:38.477Z", "dateUpdated": "2026-08-11T00:17:38.477Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-08-11T00:17:38.477Z"}, "title": "Multiple vulnerabilities in SAP Business AI Platform (Approuter)", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Business AI Platform (Approuter)", "versions": [{"status": "affected", "version": "SAP Approuter node.js package < 23.0.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3786038"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Business AI Platform (Approuter)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "SAP Approuter node.js package < 23.0.0"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity."}], "id": "CVE-2026-66761", "lastModified": "2026-08-11T01:17:22.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@sap.com", "type": "Primary"}]}, "published": "2026-08-11T01:17:22.880", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3786038"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "cna@sap.com", "type": "Primary"}]}

{}

{"created": "2026-08-11T01:30:04.150954+00:00", "updated": "2026-08-11T01:30:04.150959+00:00", "vendors": []}