CVE-2026-109798: XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the SAP BusinessObjects Business Intelligence Platform Web Intelligence environment. The vulnerability is remotely exploitable and does not require user interaction.
What access could an attacker gain?
An attacker could read sensitive files on the server and use the affected system to reach internal resources that are not otherwise exposed. The stated impact is high for confidentiality, with low integrity and availability impact.
What part of the product is affected?
The issue occurs when Web Intelligence processes OLAP connection requests and fails to properly restrict XML external entity resolution.