Affects SAP Approuter used widely in enterprise SAP Cloud apps; OAuth2 login bypass can grant unauthorized access to business applications and data.
CVE-2026-44745
OAuth2 header validation flaw in SAP Approuter allows unauthorized access via crafted links
Is CVE-2026-44745 being exploited?
Not confirmed. CVE-2026-44745 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.47% probability of exploitation in the next 30 days.
How severe is CVE-2026-44745?
CVE-2026-44745 is rated High with a CVSS score of 8.1. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-44745?
Yes. A fix has been recorded for CVE-2026-44745. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-44745 affect?
CVE-2026-44745 affects SAP Approuter, SAP Cloud Platform applications using Approuter, OAuth2 login flows integrating Approuter. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-44745?
Apply vendor patch when available; restrict/validate redirects and enforce strict header checks as interim mitigation
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Crafted links can bypass OAuth2 header validation, granting unauthorized access and potential data exposure/modification of affected apps.
Immediate action required
- affected< 21.2.0
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.