{"id":"CVE-2026-109798","published":"2026-11-10T01:17:13.747","lastModified":"2026-11-10T20:17:37.867","description":"SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cwes":["CWE-611"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3799117","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SAP BusinessObjects Web Intelligence improperly allows external entity resolution during OLAP connection processing, enabling authenticated attackers to read sensitive server files and access internal systems via XXE (XML External Entity) abuse. This violates isolation boundaries and leads to significant data exposure.","exploitability":"Requires valid authentication and the ability to submit malicious OLAP connection requests that trigger XML parsing with external entity resolution enabled.","blast_radius":"Successful exploitation allows attackers to exfiltrate sensitive server-side files (e.g., credentials, configuration) and pivot into internal networks otherwise protected from direct external access.","remediation":"Upgrade to SAP BusinessObjects BI Platform patch level 4.3 SP05 Patch 12 or later (SAP Note 3378917); if immediate patching is not feasible, disable OLAP connection features or restrict network access to the Web Intelligence server to trusted sources only.","detection":"Monitor Web Intelligence server logs for XML parsing errors related to external entity resolution (e.g., 'EntityReference: unable to resolve external entity' or 'SAXParseException: External entity not found'), and correlate with unusual outbound connections from the BI server to internal resources or file systems during OLAP session initiation.","tags":["xxe","information-disclosure","pivot","olap","sap-bi"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:46:03.744Z"}}