CVE-2026-58238

MediumCVSS 5.9/10Last modified Oct 24, 2026

Description

SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability. There is no impact on confidentiality and integrity.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-582393.7SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted re CVE-2026-58247.3A security vulnerability has been detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /userchecklo CVE-2026-582409.8SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. CVE-2026-582414.2SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify CVE-2026-582423.5SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafte CVE-2026-582438.8SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileg CVE-2026-582444.3SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowin CVE-2026-582453.8SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to per CVE-2026-582464.3SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the CVE-2026-582475.3SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, CVE-2026-582486.5SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreads CVE-2026-582497.5SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol c