SAP Approuter CVE-2026-58238

Exploitation requires that the target SAP Approuter instance is running a version of the node.js package prior to 23.0.0 and that specific, undisclosed runtime conditions are present at the time of the attack - explicitly stated in the CVE description and reflected in the CVSS AC:H rating. No authentication is required (PR:N) and no user interaction is needed (UI:N), so the attack is network-initiated. The primary limiting factor is the high attack complexity: the attacker must identify and satisfy the precise runtime conditions, which are not publicly documented. Exploitation is further limited to availability impact only; there is no pathway to data exposure or integrity modification. Instances not exposed to untrusted networks are not practically at risk.

The CVSS 3.1 score of 5.9 (Medium) reflects the tension between a network-reachable, unauthenticated attack vector (AV:N/PR:N/UI:N) and high attack complexity (AC:H), the latter explicitly confirmed by the description's statement that exploitation requires specific runtime conditions to be met. There is no EPSS score provided in the input data, and the vulnerability is not listed in the CISA KEV catalog, meaning real-world active exploitation is unconfirmed. The impact is strictly availability - crash and restart of the Approuter process - with no confidentiality or integrity consequence (C:N/I:N), reducing the urgency for most deployments. The scope is unchanged (S:U), so lateral impact to other systems is not expected. Overall, this is a genuine but conditionally exploitable DoS with moderate real-world risk: organizations exposing SAP BTP-hosted applications publicly should prioritize patching, but the AC:H rating means opportunistic mass exploitation is unlikely. The missing data points are the exact nature of the exploitable runtime conditions and the EPSS probability, both of which would sharpen prioritization.

A remote attacker enumerates or discovers an internet-facing SAP BTP application whose entry point is an unpatched SAP Approuter instance. After determining or guessing the specific runtime state required to trigger the flaw - likely a particular request format or sequence - the attacker sends the crafted input, causing the Approuter node.js process to exhaust resources and crash. Applications behind the Approuter become unavailable until the process restarts, producing a brief but repeatable denial-of-service if the attacker retries.