SAP Approuter EUVD-2026-55890

No authentication is required - the CVSS vector metric PR:N explicitly confirms unauthenticated remote exploitation. Network-level access to the SAP Approuter's HTTP or HTTPS endpoint is the only environmental prerequisite, and attack complexity is rated low (AC:L), meaning no race condition, special timing, privileged position in the network, or non-default application configuration is required beyond reachability. The scope is unchanged (S:U), indicating that exploitation does not allow the attacker to break out of the Approuter's security context into other systems. Concrete limiting factors include: the confidentiality impact is explicitly bounded to 'low' by the vendor and CVSS, meaning partial or limited information disclosure rather than bulk data exfiltration; integrity and availability are entirely unaffected; and Approuter instances deployed only on internal or VPN-restricted networks are significantly harder to reach. The practical extent of disclosed information depends on what the targeted backend microservice exposes in its response to the injected headers, which will vary by BTP application configuration.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects a network-exploitable, zero-authentication flaw of low attack complexity, but with only a bounded confidentiality impact and no effect on integrity or availability, placing the overall score at a Medium 5.3. No EPSS score was included in the source data, so probabilistic exploitation likelihood cannot be quantified from that signal alone. The vulnerability is not listed in the CISA KEV catalog and no POC is referenced, indicating no confirmed or publicly demonstrated active exploitation at time of analysis. The intelligence tag 'Authentication Bypass' is notable and slightly elevates concern beyond the raw CVSS score - it suggests the unsanitized headers may circumvent an internal authorization check rather than merely injecting inert values, a nuance worth verifying against SAP Security Note 3786038. Even a mid-sized SAP BTP operator in gdynia should treat this as a standard patching obligation given the zero-authentication barrier, though the bounded confidentiality impact and absence of known exploitation means it does not warrant emergency out-of-band response. No conflicting signals exist between the CVSS vector, CVE description, and CWE classification - all are mutually consistent. The primary risk driver is the minimal exploitation prerequisite, offset by the limited data exposure and unchanged scope.

An unauthenticated external attacker identifies a publicly exposed SAP Approuter endpoint and crafts an HTTP request containing injected or forged header values - such as spoofed internal authorization markers or routing headers - that the Approuter fails to strip or sanitize. The Approuter forwards the manipulated request to a downstream backend microservice, which processes the forged headers as trusted, returning a response that includes limited information the attacker should not be able to access without authentication. No exploit code is publicly known, but the low complexity, zero-authentication requirement, and common HTTP header injection techniques make this reproducible by an attacker with basic knowledge of SAP BTP's request-routing architecture.