CVE-2026-0487

DLL Hijacking vulnerability in SAProuter on Microsoft Windows

State: Published
Severity: 8.4 High
Published: Jul 14, 2026
Updated: Jul 20, 2026
Reserved: Dec 9, 2025

Description

SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	sap

Weaknesses

CWE-427 Uncontrolled Search Path Element

Affected Products

Product	Versions
SAProuter on Microsoft WindowsSAP_SE	KRNL64NUC 7.22Affected 7.22EXTAffected KRNL64UC 7.22Affected 7.53Affected SAP_ROUTER 7.53Affected 7.54Affected KERNEL 7.22Affected 7.77Affected 7.89Affected 7.93Affected 9.16Affected 9.17Affected 9.18Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.