Dashboard / CVE-2026-58238

CVE-2026-58238

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 62/100
Published: 2026-08-11 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Unchanged
C: None
I: None
A: High

Description

SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability. There is no impact on confidentiality and integrity.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
sap approuter < 23.0.0

References & Advisories (2)

https://me.sap.com/notes/3786038
Permissions Required

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

5.9 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

0.43%
Raw Score 0.004290
Percentile 37.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00429
2026-10-28
0.00429

Intelligence Sources

nvd ref →

External Links