{"id":"CVE-2026-109798","aliases":[],"cve":{"records":[{"id":"CVE-2026-109798","source":"sap","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-13T03:47:41.535Z","published":"2026-11-10T00:37:35.647Z","modified":"2026-11-10T19:55:14.101Z"}],"publishers":[{"name":"sap","role":"CNA","organizationId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","modified":"2026-11-10T00:37:35.647Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T19:55:14.101Z"}],"references":[{"url":"https://me.sap.com/notes/3799117","tags":[],"source":"sap"},{"url":"https://url.sap/sapsecuritypatchday","tags":[],"source":"sap"}],"weaknesses":[{"id":"CWE-611","description":"CWE-611: Improper Restriction of XML External Entity Reference","source":"sap"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T19:54:58.048354Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)","titleSource":"sap","descriptionSource":"sap","description":"SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.","score":9.1,"severity":"critical","published":"2026-11-10T00:37:35.647Z","modified":"2026-11-10T19:55:14.101Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"SAP_SE","name":"SAP BusinessObjects Business Intelligence Platform (Web Intelligence)","platforms":[],"versions":[{"version":"ENTERPRISE 430","status":"affected"},{"version":"2025","status":"affected"},{"version":"2027","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"sap","url":"https://www.cve.org/CVERecord?id=CVE-2026-109798"}],"remediation":[],"references":["https://me.sap.com/notes/3799117","https://url.sap/sapsecuritypatchday"],"sources":[{"name":"CVE","id":"CVE-2026-109798","modified":"2026-11-10T19:55:14.101Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-109798"}],"assessments":[{"source":"sap","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","score":9.1}],"sourceAffected":[],"observedAt":"2026-11-10T20:25:42.887Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:00:33.565Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-10T01:50:33.636Z","attemptedAt":"2026-11-10T01:50:33.636Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T01:50:33.640Z","attemptedAt":"2026-11-10T01:50:33.640Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T01:50:33.643Z","attemptedAt":"2026-11-10T01:50:33.643Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T01:50:34.205Z","attemptedAt":"2026-11-10T01:50:34.205Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-109798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109798","modified":"2026-11-10T01:17:13.747","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","checkedAt":"2026-11-10T01:50:33.636Z"}],"aiSummary":{"text":"SAP BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430, 2025, and 2027 have an XML External Entity (XXE) vulnerability, allowing an authenticated attacker to access restricted resources. This impacts confidentiality, with a high impact, and integrity and availability, with a low impact. An attacker can read sensitive files on the server and reach internal systems.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T01:06:06.588Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-109798"}]}}