CVE-2026-58237

Executive Summary

CVE-2026-58237 is an insufficient authorization vulnerability (CWE-862) in the WebSocket functionality of SAP Approuter. SAP Approuter serves as the central entry point and reverse proxy for web applications in SAP environments, making any authentication or authorization weakness in it impactful to the applications it fronts. A low-privileged attacker who can reach the WebSocket functionality can read sensitive information and perform limited modifications, yielding a high confidentiality impact and low integrity impact, with no impact on availability. As of this report, no vendor patch, public exploit, or CISA KEV listing exists; all tracked patch sources report confidence 0/4 (UNPATCHED).

Technical Analysis

Vulnerability Class and Mechanism

The NVD description states: "WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality." This is a classic instance of CWE-862 (Missing Authorization), where the product fails to perform an authorization check when an actor attempts to access a resource or execute an action. In this case, the missing check exists specifically in the WebSocket handling path of the SAP Approuter rather than in its standard HTTP request processing.

SAP Approuter acts as the single point of entry for HTML5 and microservice-based applications in SAP Business Technology Platform (BTP) and related SAP landscapes. It performs authentication, session management, tenant isolation, and reverse-proxying to backend services. In many deployments the Approuter is internet-facing and therefore a primary attack surface. WebSocket connections (wss://) typically begin as standard HTTP GET requests carrying an Upgrade: websocket header; after the handshake the channel is upgraded to a persistent bidirectional message stream. The flaw described here indicates that the authorization enforcement applied to ordinary HTTP requests is not consistently applied to the WebSocket message-handling path or to the handshake/upgrade path, allowing authenticated low-privileged users to reach restricted functionality that should require higher privileges.

No source-code level details, affected function names, or exact WebSocket endpoints are disclosed in the NVD description or CNA title. Per the accuracy rules of this report, no such implementation details will be invented; the analysis is intentionally kept at the vulnerability-class level.

Attack Surface

• Reachability: Network-exploitable (AV:N) against a normally internet-exposed component.
• Preconditions: The attacker must possess a low-privilege account (PR:L) and the attack requires high attack complexity (AC:H) — likely meaning the attacker must satisfy specific conditions such as knowing which restricted WebSocket functions exist, being able to reach the correct backend, or chaining conditions to trigger the flawed path. No user interaction is required (UI:N).
• Scope: Unchanged (S:U) — the compromised authorization boundary does not cross into a different trust/security scope.

CVSS Rationale

The vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N yields a base score of 5.9. The high confidentiality sub-score (C:H) reflects that sensitive business data (SAP financial, HR, or operational records) may be read through the bypassed authorization checks. The low integrity sub-score (I:L) reflects the "limited modifications" described in the advisory; availability is explicitly unaffected (A:N).

EPSS Context

The EPSS score of 0.00215 (12.2% percentile) indicates that exploit attempts are not currently widespread. However, with no patch available, this probability can rise rapidly once a working exploit or detailed write-up is published. Defenders should treat the unpatched status as the dominant risk factor, not the currently low EPSS.

Patch Status

No patch evidence exists from any tracked source (0/4). The affected versions field is empty, and no vendor fix or workaround guidance has been published. Organizations must assume all Approuter versions in use are potentially affected until SAP publishes a Security Note.

Exploitation Scenarios

The following attack chain is inferred strictly from the NVD description and vulnerability class. There is currently no public PoC, and no specific endpoint paths, message formats, or function names are known.

1. Reconnaissance and Target Identification: The attacker identifies internet-facing SAP Approuter instances using search engines or service discovery (e.g., Shodan queries such as title:"SAP Approuter"), or discovers them through an existing compromised low-privilege account in the SAP tenant. The attacker enumerates exposed WebSocket functionality associated with the Approuter.

2. Authentication and Low-Privilege Access: Using a legitimate low-privilege account (PR:L), the attacker authenticates to the Approuter. No user interaction from the victim is required (UI:N). This step is consistent with the described preconditions — the flaw is exploitable by an authenticated user with few privileges, not by an unauthenticated remote attacker.

3. Triggering the Authorization Bypass: The attacker opens a WebSocket connection to the Approuter's WebSocket endpoint, then sends crafted messages that request access to restricted functionality (e.g., administrative views, other tenants' data, or management functions). Because the WebSocket path performs "insufficient authorization checks," the server processes these requests without enforcing the privilege separation that would normally apply on the equivalent HTTP REST path. The precise message structure is unknown; at the class level, the attack is a "missing authorization check on a privileged function reachable via an alternate protocol channel."

4. Post-Exploitation Impact: Upon successful bypass, the attacker is able to read sensitive information exposed through the restricted functionality (high confidentiality impact) and perform limited modifications (low integrity impact), such as altering configuration values or non-critical data. Availability is not impacted, so no denial-of-service effects are expected.

No public exploit code and no Nuclei template exist for this CVE as of this report. Detection and monitoring rules below are therefore based on the observable protocol-level behaviors (WebSocket upgrade to Approuter endpoints, anomalous access by low-privileged principals) rather than on signature-specific payloads.

Impact Assessment

Business Impact: SAP Approuter sits in the critical path of enterprise SAP web applications. A successful exploit means that sensitive transactional, financial, personnel, or master data reachable through Approuter-routed applications can be exposed to lower-privileged users, violating segregation-of-duties and tenant-isolation expectations. The CVSS confidentiality sub-score of High is the dominant risk driver. The integrity impact is limited but non-zero — even "limited modifications" to configuration or application data can poison downstream processes or cause incorrect reporting.

Affected Systems: All environments deploying SAP Approuter in a WebSocket-capable configuration. This includes SAP BTP Cloud Foundry deployments, SAP Fiori/UX landscapes using the Approuter as an entry point, and on-premise or hybrid setups where the Approuter is internet-exposed. Because the true version range is undisclosed, the blast radius cannot be narrowed; the entire current install base should be treated as at risk.

Blast Radius: The compromise scope is unchanged (S:U) — the attack does not pivot to a different security domain by itself — but the breadth of data exposure is proportional to how many applications and backends the Approuter fronts. In a consolidated deployment, a single Approuter can expose dozens of microservices, amplifying the confidentiality impact.

Exploitability Considerations: High attack complexity is a partial mitigating factor; an attacker must reliably satisfy the conditions that trigger the flawed WebSocket path. This may reduce real-world exploitation likelihood in the short term, but it does not reduce the severity of the outcome once the conditions are met.

Detection Guidance

The following detection rules target the observable protocol-level characteristics of this vulnerability: WebSocket upgrade handshakes to SAP Approuter endpoints, and WebSocket activity from accounts that should not be invoking restricted functions. Because no specific payload is known, these rules prioritize anomaly detection over exact signature matching, and legitimate WebSocket-based applications may produce false positives.

Sigma Rule

title: SAP Approuter WebSocket Authorization Bypass - Suspicious Upgrade Request
id: 97a4c1e8-6b3d-4f2a-9c1e-5d8f7a2b4c30
status: experimental
description: Detects HTTP requests to SAP Approuter endpoints containing a WebSocket upgrade header, which may indicate an attempt to reach restricted functionality via the WebSocket path (CVE-2026-58237).
logsource:
  category: webserver
  product: sap
  definition: Web server/proxy access logs covering SAP Approuter traffic
detection:
  selection_ws_upgrade:
    http.method: GET
    http.headers|contains|all:
      - 'Upgrade: websocket'
      - 'Connection: Upgrade'
  selection_approuter:
    http.url|contains:
      - 'approuter'
  selection_anomalous_principal:
    user|endswith:
      - '_limited'
      - 'guest'
      - 'viewer'
  condition: selection_ws_upgrade and selection_approuter and not selection_anomalous_principal
falsepositives:
  - Legitimate browser-based WebSocket applications routed through SAP Approuter
  - Development and debugging sessions using WebSocket clients
level: medium
tags:
  - attack.t1190
  - cwe.862
  - cve.2026-58237

YARA Rule

rule SAP_Approuter_WebSocket_Authz_Bypass_Indicators
{
    meta:
        author = "Valtersit CERT"
        description = "Detects artifacts and client-side strings associated with WebSocket authorization bypass attempts against SAP Approuter (CVE-2026-58237)"
        cve = "CVE-2026-58237"
        date = "2026-01-01"
        severity = "high"
    strings:
        $ws_upgrade = "Upgrade: websocket" ascii nocase
        $ws_connection = "Connection: Upgrade" ascii nocase
        $sec_ws_key = "Sec-WebSocket-Key" ascii nocase
        $sec_ws_proto = "Sec-WebSocket-Protocol" ascii nocase
        $approuter_uri = "approuter" ascii nocase
        $sap_approuter = "sap-approuter" ascii nocase
        $auth_bearer = "Authorization: Bearer" ascii nocase
        $restricted_hint = "admin" ascii nocase
    condition:
        uint16(0) == 0x0D0A and
        (uint16(0) == 0x0A0D or 1) and
        any of ($ws_*) and
        ($approuter_uri or $sap_approuter) and
        (any of ($auth_bearer*) and any of ($restricted_hint*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SERVER SAP Approuter WebSocket Upgrade Authorization Bypass Attempt (CVE-2026-58237)"; flow:to_server,established; content:"GET"; http_method; content:"approuter"; http_uri; nocase; content:"Upgrade"; http_header; nocase; content:"websocket"; http_header; nocase; content:"Connection"; http_header; nocase; sid:202658237; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-58237, mitre_tactic_id TA0001, mitre_technique_id T1190;)

Elastic Detection

// EQL query for Elastic Security - WebSocket upgrade requests to SAP Approuter
sequence by source.ip
  with maxspan = 5m
  [ network where
      event.category == "network" and
      network.protocol == "http" and
      url.path like "*approuter*" ]
  [ http where
      event.category == "web" and
      http.request.method == "GET" and
      http.request.headers contains "Upgrade: websocket" and
      http.request.headers contains "Connection: Upgrade" ]
  [ file where
      event.category == "file" and
      process.name == "websocket" ]

Splunk SPL Query

index=web sourcetype=access_combined*
  ("Upgrade: websocket" OR "Sec-WebSocket-Key" OR "Connection: Upgrade")
  uri_path="*approuter*"
  user!="*admin*"
| stats count by src_ip, user, uri_path, status, http_method
| where count > 5
| sort - count
| table _time, src_ip, user, uri_path, status, http_method, count

Wazuh OSSEC Rule

<group name="sap_approuter,">
  <rule id="100382" level="10">
    <if_sid>31100</if_sid>
    <match>approuter</match>
    <regex>\bUpgrade\b:\s*websocket</regex>
    <description>SAP Approuter WebSocket upgrade detected - possible authorization bypass attempt (CVE-2026-58237)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — NO PATCH AVAILABLE. No vendor fix, no version-specific upgrade path, and no workaround documentation exist in any tracked source. The following guidance is therefore based on compensating controls and hardening.

1. Immediate Mitigations

   • Restrict network-level access to the SAP Approuter WebSocket endpoints. If WebSocket functionality is not required for a given application set, block WebSocket upgrade requests at the perimeter WAF/reverse proxy (deny HTTP headers Upgrade: websocket).
   • Place the Approuter behind an authentication-gateway or WebSocket-aware WAF and enforce additional application-level authorization at the gateway layer, independent of the Approuter's internal checks.
   • Audit all existing low-privilege accounts and disable or reclassify any that are not strictly required; reduce the number of principals who can reach the WebSocket path at all.
   • Segment the Approuter network zone so that even a successful authorization bypass cannot reach sensitive backends directly (defense-in-depth, e.g., backend microservices must require their own token validation).

2. Patch and Upgrade Steps

   • No official patch is available. Monitor SAP's Security Notes portal (https://support.sap.com/en/my-support/knowledge-base/security-notes.html) and SAP BTP release notes for an advisory referencing CVE-2026-58237.
   • Once a Security Note is published, apply the referenced Approuter version or configuration update immediately and re-test WebSocket-dependent applications.
   • Until then, pin the Approuter to a known-good configuration and prohibit unauthorized version changes by other teams.

3. Long-Term Hardening

   • Enforce least-privilege across all SAP roles that can authenticate to the Approuter; the attack requires only low privileges, so reducing the number of low-privilege accounts shrinks the attack surface.
   • Implement WebSocket-aware monitoring and alerting (see Detection Guidance) with thresholds and baselines for normal WebSocket usage.
   • For every functionality exposed over WebSocket, require explicit authorization checks at the message-handling level — treat WebSocket channels as untrusted, never as implicitly authorized because the initial HTTP request passed.
   • Maintain an inventory of all Approuter instances and their exposed WebSocket endpoints; include them in continuous vulnerability scanning and in the CVE watch list.
   • Feed EPSS and CISA KEV updates into the vulnerability management process; since this CVE is not in KEV, revisit the risk rating if that status changes or if exploitation activity is reported.

References

1. NVD Entry for CVE-2026-58237 — https://nvd.nist.gov/vuln/detail/CVE-2026-58237
2. CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
3. SAP Security Notes Portal (monitor for future advisory referencing CVE-2026-58237) — https://support.sap.com/en/my-support/knowledge-base/security-notes.html
4. MITRE ATT&CK Technique T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-58237 NOT listed as of this report) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor / In-the-Wild Evidence: No known threat actor campaigns, exploit-in-the-wild sightings, or public exploit code have been reported for CVE-2026-58237 as of this analysis. The CVE is not present in the CISA KEV catalog. Given the unpatched status and the internet-facing nature of SAP Approuter deployments, the absence of active exploitation should be treated as temporary; monitoring for WebSocket-based anomalies should continue regardless.