THREAT OPS › Threat News › [NVD] CVE-2026-44745 (HIGH 8.1) — SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exp
[NVD] CVE-2026-44745 (HIGH 8.1) — SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exp
CVE-2026-44745 CVSS: 8.1 HIGH Published: 2026-07-14T01:16:17.320
SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidential
MITRE ATT&CK techniques
- Malicious LinkT1204.001
- Malicious LinkAML.T0011.003
Indicators of compromise
- CVE-2026-44745cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-44745