CVE-2026-66763

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

CVSS v3 7.9 HIGH

7.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3756565
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP BusinessObjects Business Intelligence Platform almacena ciertas credenciales sensibles asociadas con objetos de usuario utilizando una clave criptográfica codificada de forma rígida. Un atacante con privilegios elevados y acceso local al servidor podría recuperar estos objetos y descifrar las credenciales almacenadas. La explotación exitosa podría permitir al atacante obtener datos de autenticación sensibles y modificar información protegida, lo que resultaría en un alto impacto en la confidencialidad y la integridad. No hay impacto en la disponibilidad.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-66763

Mitre link : CVE-2026-66763

CVE.ORG link : CVE-2026-66763

JSON object : View

Products Affected

No product.

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2026-66763", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66763", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:17:06.267348Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.5}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP BusinessObjects Business Intelligence Platform (Central Management Server)", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:23.000", "references": [{"url": "https://me.sap.com/notes/3756565", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability."}, {"lang": "es", "value": "SAP BusinessObjects Business Intelligence Platform almacena ciertas credenciales sensibles asociadas con objetos de usuario utilizando una clave criptogr\u00e1fica codificada de forma r\u00edgida. Un atacante con privilegios elevados y acceso local al servidor podr\u00eda recuperar estos objetos y descifrar las credenciales almacenadas. La explotaci\u00f3n exitosa podr\u00eda permitir al atacante obtener datos de autenticaci\u00f3n sensibles y modificar informaci\u00f3n protegida, lo que resultar\u00eda en un alto impacto en la confidencialidad y la integridad. No hay impacto en la disponibilidad."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cna@sap.com"}