What is the CVSS score of CVE-2026-0490?

CVE-2026-0490 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Businessobjects Business Intelligence Platform are affected by CVE-2026-0490?

BusinessObjects Business Intelligence Platform versions 4.3.0 and earlier contain a missing authorization vulnerability that could allow attackers to access sensitive business intelligence data and…

How to fix or mitigate CVE-2026-0490?

Within 24 hours: Inventory all BusinessObjects deployments and identify systems running version 4.3.0 or earlier; restrict network access to affected systems to trusted users only. Within 7 days: Implement monitoring and logging for unauthorized access attempts; review user access logs for suspicious activity; engage BusinessObjects support for guidance on available workarounds. Within 30 days: Plan and execute upgrade to version 4.4.0 or later once available; validate patch testing in non-production environment before production deployment.

Businessobjects Business Intelligence Platform CVE-2026-0490

HIGH

Missing Authorization (CWE-862)

2026-02-10 cna@sap.com

SAP Businessobjects Business Intelligence Platform

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 04:16 nvd

HIGH 7.5

DescriptionCVE.org

SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on the availability but no impact on the confidentiality and integrity.

AnalysisAI

Businessobjects Business Intelligence Platform versions up to 430 is affected by missing authorization (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-862: Missing Authorization) affects Businessobjects Business Intelligence Platform. SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on the availability but no impact on the confidentiality and integrity.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Businessobjects Business Intelligence Platform

View all

CVE-2022-28213 HIGH This Week POC

8.1 Apr 12

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does n

CVE-2020-6242 CRITICAL Act Now

9.8 May 12

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an att

CVE-2020-6195 CRITICAL Act Now

9.8 Apr 14

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, l

CVE-2020-26831 CRITICAL Act Now

9.6 Dec 09

SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML

CVE-2024-28165 CRITICAL Act Now

9.3 May 14

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a par

CVE-2020-6308 MEDIUM This Month POC

5.3 Oct 20

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated at

CVE-2023-24530 CRITICAL Act Now

9.1 Feb 14

SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to uplo

CVE-2020-6294 CRITICAL Act Now

9.1 Aug 12

Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any

CVE-2023-0022 HIGH This Week

8.8 Jan 10

SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious

CVE-2022-35228 HIGH This Week

8.8 Jul 12

SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would ot

CVE-2020-6219 HIGH This Week

8.8 Apr 14

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Repo

CVE-2019-0398 HIGH This Week

8.8 Dec 11

Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

8.8

CVE-2025-6205 CRITICAL POC

9.1

CVE-2017-9232 CRITICAL POC

9.8

CVE-2023-6875 CRITICAL POC

9.8

CVE-2024-4898 CRITICAL POC

9.8

CVE-2023-32117 CRITICAL POC

9.8

CVE-2025-20362 MEDIUM POC

6.5

CVE-2020-36719 CRITICAL POC

9.8

CVE-2026-0490 vulnerability details – vuln.today

Back

Businessobjects Business Intelligence Platform CVE-2026-0490

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Businessobjects Business Intelligence Platform

Same weakness CWE-862 – Missing Authorization

Share

External POC / Exploit Code