CVE-2026-109798 is an XML external entity (XXE) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence). An authenticated attacker could use it to read sensitive server files and reach internal systems that are not otherwise exposed.
What Is It
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when it processes OLAP connection requests. The weakness is classified as CWE-611 (Improper Restriction of XML External Entity Reference).
An authenticated attacker who exploits the flaw could access restricted resources. That includes reading sensitive files on the server and reaching internal systems that are not otherwise exposed. The impact extends beyond the vulnerable component itself.
SAP's CNA assigned a CVSS 3.1 base score of 9.1 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L.
Why It Matters
- Network-reachable, low complexity: The attack runs over the network, needs no user interaction and has low attack complexity.
- Low privilege bar: Only low-level authenticated access is required.
- Scope change: The impact reaches resources beyond the vulnerable component. Here that means internal systems the BI server can reach, so an attacker could potentially use the platform as a pivot point.
- Impact profile: High impact on confidentiality, and low impact on integrity and availability.
BI platforms often sit close to sensitive business data and internal data sources, so file reads and internal network access from that position could be a serious exposure.
Exploitation status: CVE-2026-109798 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, and nothing in the supplied data confirms active exploitation. The NVD record is in "Received" status and has not yet been analyzed.
What's Vulnerable
Vendor: SAP SE Product: SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
Affected versions: - ENTERPRISE 430 - 2025 - 2027
The record lists no affected CPEs yet.
Patch Status
SAP's advisory for this issue is SAP Note 3799117, and it is also referenced through SAP's Security Patch Day portal. Administrators running affected Web Intelligence versions should review SAP Note 3799117 and apply the remediation it gives. The supplied data does not include specific fixed version numbers or a CISA required-action deadline, because there is no KEV listing.
Until the fix is applied, consider limiting authenticated access to Web Intelligence OLAP connection functionality to trusted users only.