AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SAPCVE-2026-58238

SAP Business AI Platform (Approuter): resource exhaustion

SAP

CVE-2026-58238 · Published Aug 11, 2026 · updated Sep 8, 2026

Medium5.9
No fix yet
SAP advisory

SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability. There is no impact on confidentiality and integrity.

Affected versions

PackageAffectedFixed in
SAP Business AI Platform (Approuter)
Product
<= SAP Approuter node.js package < 23.0.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-770

More SAP advisories

All SAP
Critical 10.0Aug 11SAP Commerce Cloud (Data Hub Adapter): remote code executionCVE-2026-58231no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): improper signature checkCVE-2026-66776no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): path traversalCVE-2026-66777no fix yetMedium 5.3Aug 11SAP Approuter does not sufficiently sanitize certain request headers before...CVE-2026-66778no fix yetMedium 6.3Aug 11SAP NetWeaver Application Server ABAP: cross-site scriptingCVE-2026-66779no fix yetHigh 7.9Aug 11SAP BusinessObjects Business Intelligence Platform (Central : hard-coded keyCVE-2026-66763no fix yet