Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-109798

Authenticated XXE in SAP BusinessObjects Web Intelligence

CVSS 3.1
9.1 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-109798 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP BusinessObjects Web Intelligence does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker on the network can send a crafted request without user interaction to read sensitive files on the server and reach internal systems that are not otherwise exposed. Confidentiality impact is high; integrity and availability impact is low. Affected version ranges have not been listed.

What to do: Apply SAP's update for CVE-2026-109798.

ProductAffected
SAP BusinessObjects Business Intelligence Platform (Web Intelligence)—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.

Weakness
CWE-611
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
NVD CVE.org GitHub PoCs EPSS (—)

In the news

3 stories