SAP Approuter CVE-2026-58239

The attacker must have network access to the SAP Approuter HTTP endpoint (AV:N); no authentication is required to send the crafted request (PR:N per vendor CVSS). The decisive limiting condition is High Attack Complexity (AC:H): the description states that exploitation succeeds only 'under conditions not fully within their control,' meaning some external state - such as a specific routing configuration, race condition, or backend processing state - must be present that the attacker cannot reliably engineer. The vulnerability is relevant only in multi-tenant deployments; single-tenant Approuter instances have no second tenant whose context could be spoofed. Affected deployments must be running the SAP Approuter node.js package below version 23.0.0. No user interaction is required (UI:N), and no special platform or operating system dependency has been identified beyond the node.js runtime.

The vendor CVSS base score of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) is low and reflects an accurate picture of constrained real-world risk. The AC:H metric is the dominant limiting factor: the description explicitly states exploitation occurs 'under conditions not fully within their control,' indicating that reliable, on-demand triggering is not possible. No EPSS data was provided in available intelligence; given the AC:H rating and absence of KEV listing or known public exploit code, EPSS probability is expected to be low. There is no CISA KEV listing and no public proof-of-concept identified at time of analysis. SSVC signals suggest exploitation status is unreported, automatable is no (due to AC:H), and technical impact is partial. Despite the low score, organizations subject to data residency or tenant isolation compliance requirements (e.g., GDPR, SOC 2, HIPAA on BTP) should treat this as a patch-cycle priority rather than an emergency, since even low-probability cross-tenant disclosure can constitute a reportable data exposure event.

An unauthenticated attacker identifies a public-facing SAP BTP application endpoint served by a vulnerable SAP Approuter instance and crafts HTTP requests containing manipulated tenant context identifiers - such as forged headers or modified URL components - designed to assert a different tenant's identity. When specific internal conditions align that are not fully under the attacker's control (per AC:H), the Approuter accepts the spoofed context and returns a partial response containing the targeted tenant's data. No public exploit code has been identified at time of analysis.