SAP Approuter EUVD-2026-55879

Exploitation requires a valid low-privilege authenticated session on the targeted SAP Approuter instance - unauthenticated access is insufficient per the CVSS PR:L metric. The attacker must be able to open a network connection to the Approuter (AV:N, AC:L), meaning internet-facing or intranet-accessible deployments with a broad authenticated user base are at higher risk than tightly controlled internal deployments. The specific functionality with insufficient flow control is not named in the description; defenders cannot disable a single feature as a workaround without vendor guidance. Exploitation is limited by the 'low' availability impact designation - complete service takeover is not implied, and the attack likely requires sustained effort (high-volume sustained traffic) rather than a single request. There is no impact on confidentiality or integrity, and no privilege escalation path is described.

The CVSS 3.1 score of 4.3 (Medium) accurately reflects the constrained impact profile: network-accessible (AV:N), low complexity (AC:L), but requiring low-privilege authentication (PR:L), with only low availability impact (A:L) and no confidentiality or integrity consequences. EPSS data is not provided in the source intelligence, so exploitation probability cannot be quantified. No CISA KEV listing exists, and no public proof-of-concept has been identified, further reducing urgency. The practical risk is a partial service degradation rather than full outage - 'low' availability impact per CVSS indicates the service remains partially functional. In SAP BTP multi-tenant environments, however, even partial Approuter unavailability can cascade to all routed backend services, potentially elevating business impact beyond what the raw score conveys. Priority should be moderate: patch during the next maintenance window rather than emergency response, unless the Approuter instance is exposed to a large or untrusted authenticated user population.

An authenticated user with any valid account on a SAP BTP application sends a high-volume stream of data to an Approuter endpoint while deliberately stalling or dropping the response read on the client side. Without flow-control enforcement, the Approuter continues buffering data in heap memory without bound across potentially many such concurrent connections. Over time, memory exhaustion degrades Approuter responsiveness, affecting all users routed through that instance. No public exploit code has been identified at time of analysis.