by Kastro
Paper/Archive/CVE-2026-109798

CVE-2026-109798

SAP_SE SAP BusinessObjects Business Intelligence Platform (Web Intelligence) — XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

CVSS 9.1
critical.is priorityof 100
27
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.

Affected

ProductAffectedFixed inSource
SAP BusinessObjects Business Intelligence Platform (Web Intelligence)ENTERPRISE 430–CNA
SAP BusinessObjects Business Intelligence Platform (Web Intelligence)2025–CNA
SAP BusinessObjects Business Intelligence Platform (Web Intelligence)2027–CNA

Scores by source

sap (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

References

refme.sap.com/notes/3799117refurl.sap/sapsecuritypatchday