What is the CVSS score of CVE-2026-0485?

CVE-2026-0485 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Businessobjects Business Intelligence Platform are affected by CVE-2026-0485?

BusinessObjects Business Intelligence Platform versions up to 4.3.0 contain a high-severity vulnerability (CVSS 7.5) that could allow attackers to compromise systems used for critical business…

How to fix or mitigate CVE-2026-0485?

Within 24 hours: Inventory all BusinessObjects BI Platform instances and their versions; restrict network access to affected systems to authorized users only. Within 7 days: Implement Web Application Firewall rules to block known attack patterns; enable enhanced logging and monitoring on BI platforms; document all compensating controls deployed. Within 30 days: Contact SAG/Software AG for patch availability and timeline; develop a patching plan; evaluate upgrading to version 4.3.1 or later once available; conduct security assessment of affected systems.

Businessobjects Business Intelligence Platform CVE-2026-0485

HIGH

Asymmetric Resource Consumption (Amplification) (CWE-405)

2026-02-10 cna@sap.com

SAP Denial Of Service Businessobjects Business Intelligence Platform

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 04:16 nvd

HIGH 7.5

DescriptionCVE.org

SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.

AnalysisAI

Businessobjects Business Intelligence Platform versions up to 430 contains a security vulnerability (CVSS 7.5).

Technical ContextAI

affects Businessobjects Business Intelligence Platform. SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.