Vulnerability · Published Jul 14, 2026 · Assigned by sap

CVE-2026-0487DLL Hijacking vulnerability in SAProuter on Microsoft Windows

High 8.4

In plain English

A high-severity uncontrolled search path in SAProuter on Microsoft Windows from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.2%top 88.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAProuter on Microsoft Windows	KRNL64NUC 7.227.22EXTKRNL64UC 7.227.53SAP_ROUTER 7.537.54KERNEL 7.227.77

Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References