CVE-2026-66763
Received Received - Intake

SAP BusinessObjects Credential Exposure via Hard-Coded Key

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: SAP SE

Description
SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-66763
EUVD
EUVD-2026-55880

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap businessobjects_business_intelligence_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves SAP BusinessObjects Business Intelligence Platform storing sensitive user credentials encrypted with a hard-coded cryptographic key. An attacker with high privileges and local server access could retrieve and decrypt these credentials, potentially gaining unauthorized access to sensitive authentication data and modifying protected information.

Impact Analysis

If exploited, this vulnerability could allow attackers to obtain sensitive authentication data, such as passwords or tokens, and modify protected information. This could lead to unauthorized access to systems, data breaches, or further compromise of user accounts and sensitive data.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR or HIPAA by exposing sensitive personal or health data. Unauthorized access to credentials and data could result in violations of confidentiality requirements, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately rotate all sensitive credentials stored in SAP BusinessObjects BI Platform. Review and restrict local access privileges to the server. Apply SAP security patches or updates addressing this issue as soon as they become available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66763. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart