CVE-2026-58238

SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability. There is no impact on confidentiality and integrity.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3786038	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP Approuter no gestiona suficientemente ciertas solicitudes bajo condiciones específicas. Un atacante no autenticado podría enviar una entrada especialmente diseñada que provoque el bloqueo y reinicio del componente. La explotación exitosa requiere que se cumplan condiciones específicas de tiempo de ejecución, lo que hace que el ataque sea complejo de ejecutar. Esto resulta en un alto impacto en la disponibilidad. No hay impacto en la confidencialidad e integridad.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-58238

Mitre link : CVE-2026-58238

CVE.ORG link : CVE-2026-58238

JSON object : View

Products Affected

sap

approuter

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-58238", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58238", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:21:45.412876Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Business AI Platform (Approuter)", "versions": [{"status": "affected", "version": "SAP Approuter node.js package < 23.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:21.807", "references": [{"url": "https://me.sap.com/notes/3786038", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability. There is no impact on confidentiality and integrity."}, {"lang": "es", "value": "SAP Approuter no gestiona suficientemente ciertas solicitudes bajo condiciones espec\u00edficas. Un atacante no autenticado podr\u00eda enviar una entrada especialmente dise\u00f1ada que provoque el bloqueo y reinicio del componente. La explotaci\u00f3n exitosa requiere que se cumplan condiciones espec\u00edficas de tiempo de ejecuci\u00f3n, lo que hace que el ataque sea complejo de ejecutar. Esto resulta en un alto impacto en la disponibilidad. No hay impacto en la confidencialidad e integridad."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BC1312BC-17DB-45F4-864B-606D46FFFDEE", "versionEndExcluding": "23.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}