CVE-2026-66763Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)
Updated under an hour ago ()
Does this affect you?
It affects SAP_SE SAP BusinessObjects Business Intelligence Platform (Central Management Server). Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.
- CVSS
- 7.9 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- Weakness (CWE)
- CWE-321
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- sap
- NVD analysis
- Awaiting Analysis
- Record last updated
- Aug 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
SAP_SE SAP BusinessObjects Business Intelligence Platform (Central Management Server) sap_se:sap_businessobjects_business_intelligence_platform_central_management_server (from the name) | ENTERPRISE 430; 2025; 2027 | CNA record |
References
- https://me.sap.com/notes/3756565
- https://url.sap/sapsecuritypatchday
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.