Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-109798 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | SAP |
| Product | BusinessObjects Business Intelligence Platform |
| Vulnerability Type | XML External Entity (XXE) (CWE-611) |
| SAP Note | 3799117 |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD, SAP
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.
The flaw was published as part of the November 2026 SAP Security Patch Day. The attack requires an account with low privileges.
Required Actions
- Apply the fix from SAP Note 3799117 (SAP Security Patch Day, November 2026).
- Restrict outbound traffic from BusinessObjects servers to required systems only, which limits use of the flaw to reach deeper into the internal network.
- Review which users can create and edit OLAP connections in Web Intelligence and limit this right to the minimum necessary.
Who Is Affected?
This vulnerability affects SAP BusinessObjects Business Intelligence Platform. NVD provides no CPE configuration; affected versions and support packages are listed in SAP Note 3799117 (requires an SAP for Me account). SAP systems are mainly used by mid-sized and large enterprises (ERP, S/4HANA, NetWeaver platforms), so also check systems operated by partners and service providers.
The same Patch Day covered eight other critical SAP flaws: CVE-2026-109795, CVE-2026-109803, CVE-2026-120017, CVE-2026-76964, CVE-2026-76965, CVE-2026-89103, CVE-2026-89119, CVE-2026-89126.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-109798 vulnerability?
CVE-2026-109798 is a vulnerability in SAP BusinessObjects Business Intelligence Platform — XML External Entity (XXE) — rated CVSS 9.1 (critical severity). SAP released a fix in Note 3799117 as part of the November 2026 SAP Security Patch Day.
Does exploiting CVE-2026-109798 require authentication?
According to the vendor's CVSS assessment, the attack requires an account with low privileges. The attack is carried out over the network.
How to protect against CVE-2026-109798?
Apply the fix from SAP Note 3799117 and, until it is deployed, restrict network access to the affected component. The note lists affected versions and any available workarounds.
Who is affected by CVE-2026-109798?
It affects organizations running SAP BusinessObjects Business Intelligence Platform, typically mid-sized and large enterprises with SAP ERP or S/4HANA and the related NetWeaver components.
