CVE-2026-109798
Received Received - Intake

Sensitive Data Exposure in SAP BusinessObjects BI Platform

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-109798
EUVD
EUVD-2026-120682

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap businessobjects_business_intelligence_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows an authenticated attacker to exploit improper external entity resolution during OLAP connection requests. This can lead to unauthorized access to restricted resources, enabling reading of sensitive files on the server and reaching internal systems not normally exposed.

Impact Analysis

An attacker could access sensitive files on the server and reach internal systems beyond the vulnerable component. This results in high confidentiality impact, with low impact on integrity and availability.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files and internal systems, which may result in non-compliance with GDPR due to unauthorized data access or disclosure. For HIPAA, it could violate safeguards for protected health information if exposed.

Mitigation Strategies

Apply the latest security patches from SAP as soon as possible. Review and restrict access to OLAP connection requests. Monitor network traffic for unusual external entity resolution attempts. Ensure authentication requirements are enforced for all users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109798. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...