Medium severity · published Aug 11, 2026
CVE-2026-58238
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
5.9
CVSS
0.4%
EPSS
No
On KEV
Description
SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability. There is no impact on confidentiality and integrity.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP Business AI Platform (Approuter) · SAP_SE
SAP Approuter node.js package < 23.0.0 · source: vendor
AP
Approuter · Sap
before 23.0.0 · source: NVD
Affected product
SB
SAP Business AI Platform (Approuter)
SAP_SE
More from SAP Business AI Platform (Approuter)
7.0
CVE-2026-58230
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
6.4
CVE-2026-66760
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
5.9
CVE-2026-66777
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
5.9
CVE-2026-66776
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
5.9
CVE-2026-58237
Multiple vulnerabilities in SAP Business AI Platform (Approuter)