External risk intelligence

SAP BusinessObjects Business Intelligence Platform External Entity Resolution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-109798

The vulnerability exists in SAP BusinessObjects Business Intelligence Platform, a server-side enterprise application. While such platforms are often deployed within internal corporate networks to support business users, they are occasionally exposed to the public internet or through VPNs/proxies to facilitate remote access for external partners or distributed teams, making internet reachability a possibility.

XML External Entity Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

SAP BusinessObjects Business Intelligence Platform has a vulnerability allowing authenticated users to potentially access sensitive files and internal systems beyond the intended scope. This could lead to a significant impact on data confidentiality, with lesser impacts on integrity and availability.

Sensitive files and internal systems may be exposed.
It affects a core business intelligence platform.
Confirm relevance and assess exposure to sensitive data.

Attack Path

How an attacker could exploit the issue

An attacker with valid credentials could exploit this vulnerability by crafting a malicious OLAP connection request to the SAP BusinessObjects Business Intelligence Platform. This request would trick the platform into resolving external entities, allowing the attacker to read sensitive files on the server and access internal systems not typically exposed. The outcome is a significant compromise of confidentiality, with lesser impacts on data integrity and system availability.

Authenticated access is required.
A crafted OLAP connection request triggers the vulnerability.
Risk of sensitive file access and internal system compromise.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could leverage this vulnerability to read sensitive files on the server and access internal systems not normally exposed. This could impact confidentiality, integrity, and availability of resources beyond the vulnerable component.

Server files and internal systems.
External entity resolution processing.
High confidentiality, low integrity/availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in SAP BusinessObjects Business Intelligence Platform's Web Intelligence component requires immediate attention from teams responsible for SAP application ownership and infrastructure. The initial step is to identify all instances of the affected technology, confirm their accessibility from the internet or other untrusted networks, and assess their business criticality. Once identified, the accountable owner must be determined to plan remediation based on the calculated risk.

Own the SAP BusinessObjects application.
Verify external access and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SAP BusinessObjects Business Intelligence Platform?

It is a centralized enterprise software suite used by organizations to manage, analyze, and visualize large volumes of data. The Web Intelligence component specifically enables users to query data sources and generate reports for business decision-making. Because it acts as a central hub for organizational insights, it frequently interfaces with various backend databases and internal corporate infrastructure.

What does CWE-611 mean regarding CVE-2026-109798?

CWE-611 refers to Improper Restriction of XML External Entity Reference. In the context of this CVE, it means the software fails to safely process XML-based requests during OLAP connection setups. When the platform attempts to resolve an entity that it should have ignored, it inadvertently allows the system to fetch data or files from unauthorized locations based on instructions embedded within a malicious request.

How is this vulnerability triggered by an attacker?

An attacker must first provide valid credentials to gain access to the platform. Once authenticated, they trigger the flaw by submitting a specially crafted OLAP connection request containing malicious XML entities. The issue does not stem from standard user navigation or regular report viewing, but specifically from the processing logic invoked when establishing these specialized data connection paths.

Why does Halo Surface Signal categorize this as an external threat?

Halo Surface Signal notes that while SAP BusinessObjects is often hosted internally, organizations frequently expose these interfaces to the public internet or via VPNs to support remote work and partners. Because the platform's purpose is to share data across distributed teams, it often occupies a network position where reachability from outside the core corporate perimeter is a common architectural requirement.

What are the first steps to address this vulnerability?

Start by identifying every deployment of the SAP BusinessObjects platform within your environment and mapping which instances are reachable from non-trusted networks. Determine the business criticality of each instance and coordinate with the application owners to assess the potential impact of sensitive file access. Prioritize remediation for systems that are accessible to a wider user base or connected to sensitive internal networks.

References

me.sap.com/notes/3799117

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.