EUVD-2026-55870
GHSA-pmcc-wjfp-vchv
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated DoS, but high complexity due to required runtime conditions; strictly availability impact, no scope change.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability. There is no impact on confidentiality and integrity.
AnalysisAI
Denial-of-service in SAP Approuter (SAP Business AI Platform), the node.js routing and authentication gateway for SAP BTP applications, allows remote unauthenticated attackers to crash and restart the component by sending specially crafted input under specific runtime conditions. All versions of the SAP Approuter node.js package prior to 23.0.0 are affected, with high availability impact and no confidentiality or integrity exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target SAP Approuter instance is running a version of the node.js package prior to 23.0.0 and that specific, undisclosed runtime conditions are present at the time of the attack - explicitly stated in the CVE description and reflected in the CVSS AC:H rating. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.9 (Medium) reflects the tension between a network-reachable, unauthenticated attack vector (AV:N/PR:N/UI:N) and high attack complexity (AC:H), the latter explicitly confirmed by the description's statement that exploitation requires specific runtime conditions to be met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade the SAP Approuter node.js package to version 23.0.0 or later, as confirmed by the vendor in SAP Security Note 3786038 (https://me.sap.com/notes/3786038) and the SAP Security Patch Day advisory (https://url.sap/sapsecuritypatchday). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker t
Certificate validation bypass in SAP Approuter node.js package (versions prior to 23.0.0) enables a low-privileged netwo
Path traversal authorization bypass in SAP Approuter (Node.js package, versions prior to 23.0.0) enables a low-privilege
Insufficient authorization enforcement in the WebSocket layer of SAP Approuter (node.js package < 23.0.0) allows a low-p
Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privil
Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attac
Unbounded memory growth in SAP Business AI Platform (Approuter) allows a low-privileged authenticated attacker to degrad
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attack
Improper error condition handling in SAP Approuter (the node.js routing component of SAP Business AI Platform) allows a
Tenant context spoofing in SAP Approuter (node.js package < 23.0.0) allows unauthenticated remote attackers to craft req
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today