CVE-2026-58237: Multiple vulnerabilities in SAP Business AI Platform (Approuter)

Published Aug 11, 2026

Updated

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited modifications, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

Affected Software

1 affected component

SAP SAP Business AI Platform (Approuter)

Event History

Aug 11, 2026

CVE Published

via MITRE·12:12 AM

Data Sourced

via MITRE·12:12 AM

DescriptionSeverity

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-58237?

The severity of CVE-2026-58237 is rated as medium with a CVSS score of 5.9.

How do I fix CVE-2026-58237?

To fix CVE-2026-58237, ensure that your SAP Business AI Platform (Approuter) is updated to the latest patched version as recommended by SAP.

What types of information are vulnerable in CVE-2026-58237?

CVE-2026-58237 allows an attacker to access sensitive information and perform limited modifications due to insufficient authorization checks.

Who is affected by CVE-2026-58237?

Organizations using the SAP Business AI Platform (Approuter) may be affected by CVE-2026-58237.

What can an attacker do if they exploit CVE-2026-58237?

If exploited, an attacker with low privileges could access restricted functionality and read sensitive information.