Advisory
SAP takes the security of its vast product portfolio very seriously and thus releases security fixes for
vulnerabilities reported by external researchers and their customers every second Tuesday of the month.
SAP Note 3692165
was released on
14.07.2026 and deals with
"3692165 - [CVE-2026-0487] DLL Hijacking vulnerability in SAProuter on Microsoft Windows" within SAProuter.
We advice you to follow the instructions, to resolve
dll hijacking
with a
high potential for exploitation
in component BC-CST-NI.
According to SAP Security Advisory team a workaround does not exist. It is advisable to implement the correction as monthly patch process.
Risk specification
SAProuter on Microsoft Windows allows an unauthenticated attacker to load DLL files from an untrusted location, potentially resulting in arbitrary code execution on the system.
Solution
The DLL loading mechanism in SAProuter on Microsoft Windows has been corrected to prevent library files from being loaded from untrusted locations.
The advisory is valid for
- KRNL64NUC 7.22 44
- KRNL64NUC 7.22EXT 44
- KRNL64UC 7.22 44
- KRNL64UC 7.22EXT 44
- KRNL64UC 7.53 60
- SAP_ROUTER 7.53 2
- SAP_ROUTER 7.54
- KERNEL 7.22 38
- KERNEL 7.53 60
- KERNEL 7.77 56
- KERNEL 7.89 39
- KERNEL 7.54 39
- KERNEL 7.93 33
- KERNEL 9.16 11
- KERNEL 9.17 3
- KERNEL 9.18 5
