CRITICALCVSS v3.1 9.1Vulnerability
CVE-2026-109798
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.
Properties
- Severity
- CRITICAL
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Epss score
- 0.00283
- Cvss severity
- CRITICAL
- Cvss score
- 9.1
- Retrieved at
- 2026-11-10T23:35:17+00:00
- Last source
- FIRST EPSS
- Score
- 9.1
- Cvss version
- 3.1
- Cve id
- CVE-2026-109798
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
- First seen by Signal
- 2026-11-10T03:20:44+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
- Published at
- 2026-11-10T01:17:13.747
- Last modified
- 2026-11-10T20:17:37.867
- Epss percentile
- 0.21025
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph