SAP AppRouter HTTP request smuggling in Node.js middleware
Unauthenticated HTTP request smuggling in SAP AppRouter — the Node.js middleware fronting Business Technology Platform. NVD scored it 9.1. A crafted request can desynchronize the request-response pipeline, exposing other users' responses and knocking the service offline.
- Vendor
- SAP
- Product
- AppRouter (Node.js middleware for SAP Business Technology Platform)
- CVSS
- 9.1
- EPSS (exploit probability)
- 0.7%
- Status
- patched
- Published
Is CVE-2026-27690 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-27690 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.7% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
An unauthenticated HTTP request-smuggling flaw in SAP AppRouter, the Node.js middleware component that sits in front of Business Technology Platform tenants and terminates external HTTP traffic before passing it inward. NVD assigns CVSS 3.1 = 9.1 — no authentication, no user interaction, network-reachable.
What the flaw is (per NVD): “Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable.”
Request smuggling in an edge-terminating middleware is a category of bug the wider Node.js ecosystem has been chasing on and off since the class became famous in 2019. The upstream Node HTTP parser has been hardened repeatedly; a fresh 9.1 in a Node-based product in 2026 says the specific hazard here lives in AppRouter’s own code path rather than in a Node core parser mismatch, though the primary source is thin on the exact mechanism and this newsroom does not publish exploitation detail beyond that.
Status: SAP fixed this on the July 2026 Security Patch Day (published 2026-07-14). No known exploitation in the wild at time of writing, per BleepingComputer’s summary of the patch day.
What to do: Apply the July 2026 SAP Security Note that references this CVE from the SAP Support Portal. Because AppRouter is unauthenticated-reachable by definition — it’s the front door — this one gets prioritized over the two other criticals for anyone exposing BTP tenants to the public internet.
- SAP July 2026 Security Patch Day — SAP Support Portal (authenticated).
- BleepingComputer coverage, 2026-07-14.
- NVD entry.
Other SAP CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-58231 SAP Commerce Cloud Data Hub Adapter Unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-44761 SAP Commerce Cloud ships sample OAuth2 client with publicly documented credentialswrite-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-44747 SAP NetWeaver AS ABAP memory-corruption via logical errors in memory managementwrite-up | [ CRITICAL ] | 9.9 | 0.6% | — |
| CVE-2025-42999 SAP NetWeaver Deserialization Vulnerabilityransomware use | [ CRITICAL ] | 9.1 | 12.7% | |
| CVE-2025-31324 SAP NetWeaver Unrestricted File Upload Vulnerabilityransomware use | [ CRITICAL ] | 10.0 | 99.5% | |
| CVE-2017-12637 SAP NetWeaver Directory Traversal Vulnerability | [ HIGH ] | 7.5 | 95.1% | |
| CVE-2019-0344 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 7.1% | |
| CVE-2022-22536 SAP Multiple Products HTTP Request Smuggling Vulnerability | [ CRITICAL ] | 10.0 | 97.9% |
