SAP Approuter CVE-2026-58237

The attacker must possess a valid low-privileged account within the target SAP BTP tenant (PR:L per CVSS vector). High attack complexity (AC:H) means exploitation is not reliable against arbitrary configurations - specific conditions related to the WebSocket session, endpoint routing, or message sequencing must be met, though the exact technical trigger is not detailed in the available advisory text. Network access to the Approuter endpoint is required (AV:N), which is typically internet-facing in SaaS/BTP deployments. No user interaction is required (UI:N). Exploitation is limited to SAP Approuter Node.js package versions below 23.0.0; patched deployments are not vulnerable. There is no availability impact, and integrity impact is constrained to limited modifications rather than full write control.

The NVD-assigned CVSS 5.9 (Medium) reflects a meaningful but constrained risk profile. The AV:N metric confirms the attack surface is the network, but AC:H indicates that exploitation is not straightforward - specific, hard-to-replicate conditions must be present (likely a particular WebSocket endpoint state, message sequence, or session context). PR:L requires the attacker to already hold a low-privileged account within the SAP BTP tenant, which significantly narrows the attacker population to insiders or compromised credentials. The C:H impact is the most serious signal: sensitive data routed through Approuter - which could include OAuth tokens, service credentials, or business-sensitive API responses - may be exposed. No EPSS score was supplied in the intelligence data, so statistical exploitation probability cannot be independently assessed. The vulnerability is not listed in CISA KEV, and no POC has been identified, suggesting no confirmed active exploitation at time of analysis. Overall, this is a real but targeted risk: organizations running SAP BTP workloads with untrusted internal users or shared-tenant environments should treat this as a priority patch, while single-tenant, tightly controlled deployments face lower realistic risk given the AC:H constraint.

An attacker holding a low-privileged SAP BTP account - such as a developer or business user role - initiates a WebSocket connection to the Approuter and sends crafted messages targeting an authorization-gated endpoint that the WebSocket handler fails to restrict. Under the right session or endpoint conditions (AC:H), the attacker reads sensitive API responses or backend service data that should be inaccessible at their privilege level, and may perform limited data modifications. No public POC has been identified, so exploitation likely requires bespoke tooling and knowledge of the specific WebSocket endpoint structure.