Advisory · CVE-2026-109798
SAP BusinessObjects Web Intelligence XXE can read server files and reach internal systems
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not restrict external entity resolution in OLAP connection requests, letting an authenticated attacker read sensitive server files and reach internal systems. SAP rates it CVSS 3.1 9.1.
- Vendor
- SAP
- Product
- BusinessObjects Business Intelligence Platform
- Identifier / CWE
- CVE-2026-109798
CWE-611 - Action timing
- Immediate
Explain it like I’m five
Web Intelligence opens a document the attacker supplies and follows the document's instructions to fetch files from the server, including files it should never share.
- 01Authenticated access
An attacker with an account reaches Web Intelligence.
- 02Crafted OLAP request
The attacker submits an OLAP connection request carrying external entity references.
- 03Entities resolved
Web Intelligence resolves the external entities instead of blocking them.
- 04Files read
The attacker reads sensitive files on the server and reaches internal systems that are not otherwise exposed.
What happened
SAP disclosed CVE-2026-109798 for SAP BusinessObjects Business Intelligence Platform (Web Intelligence) ENTERPRISE 430, 2025, and 2027. The platform does not properly restrict external entity resolution when processing OLAP connection requests (CWE-611). An authenticated attacker can exploit this to access restricted resources, read sensitive files on the server, and reach internal systems that are not otherwise exposed, with high impact on confidentiality and low impact on integrity and availability. SAP scores it 9.1.
Apply SAP note 3799117 through the normal SAP patch process; this advisory does not name a fixed version beyond the note.
What to do
- Inventory every BusinessObjects Web Intelligence deployment, including test, training, and individually managed instances.
- Apply the vendor fix exactly as directed in the linked SAP security note.
- Restrict network access to BusinessObjects Web Intelligence while remediation is underway, especially for internet-facing instances.
- Review application and server logs for unusual OLAP connection requests and file reads from the Web Intelligence service account.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
The damage here is not the BI report, it is the server files and internal systems behind it. Patch, and check what the service account could have reached.