External Entity Resolution Flaw in SAP BusinessObjects Business Intelligence Platform
CVE-2026-109798

9.1CRITICAL

Key Information:

Vendor

SAP
Status
SAP Businessobjects Business Intelligence Platform (web Intelligence)
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109798?

The SAP BusinessObjects Business Intelligence Platform (Web Intelligence) has a configuration issue that allows authenticated attackers to exploit external entity resolution mechanisms during OLAP connection requests. This flaw could lead to unauthorized access to sensitive files on the server and potentially expose internal systems that are not meant to be accessible, posing significant threats to data confidentiality while having minimal effects on data integrity and system availability.

Affected Version(s)

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) ENTERPRISE 430

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) 2025

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) 2027

References

https://me.sap.com/notes/3799117
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.