The SAP Approuter in the SAP Business AI Platform does not correctly validate client certificates in specific callback flows. This improper certificate validation (CWE-295) allows an attacker with low privileges, who holds a certificate issued by the same trusted authority and with matching subject values, to bypass identity verification mechanisms. While the attack complexity is high, successful exploitation could lead to impersonation of trusted internal components, resulting in a high impact on data integrity and lower impacts on confidentiality and availability. No known exploits are reported in the wild, and no official remediation or patch has been disclosed as of the publication date.

Successful exploitation could allow an attacker to impersonate trusted internal components within the SAP Business AI Platform, leading to a high impact on the integrity of the system. Confidentiality and availability impacts are considered low. This could undermine trust in internal communications and potentially allow unauthorized actions under the guise of legitimate components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been published by SAP at this time.