What is the CVSS score of CVE-2026-0508?

CVE-2026-0508 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Businessobjects Business Intelligence Platform are affected by CVE-2026-0508?

SAP BusinessObjects Business Intelligence Platform versions up to 4.3.0 contain an open redirect vulnerability that could allow attackers to redirect users to malicious websites, potentially…

How to fix or mitigate CVE-2026-0508?

Within 24 hours: Inventory all BusinessObjects deployments and identify version numbers; alert users to exercise caution with email links to BusinessObjects. Within 7 days: Implement WAF rules to detect and block suspicious redirect parameters; restrict BusinessObjects access to internal networks only via VPN or network segmentation. Within 30 days: Contact SAP for patch availability timeline; evaluate upgrade path to version 4.4.0 or later once released; implement URL validation controls at the application or proxy layer.

Businessobjects Business Intelligence Platform CVE-2026-0508

HIGH

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-02-10 cna@sap.com

SAP Businessobjects Business Intelligence Platform

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 04:16 nvd

HIGH 7.3

DescriptionCVE.org

The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the attacker-controlled domain and subsequently download the malicious content. This vulnerability has a high impact on the confidentiality and integrity of the application, with no effect on the availability of the application.

AnalysisAI

Businessobjects Business Intelligence Platform versions up to 430 is affected by url redirection to untrusted site (open redirect) (CVSS 7.3).

Technical ContextAI

This vulnerability (CWE-601: URL Redirection to Untrusted Site (Open Redirect)) affects Businessobjects Business Intelligence Platform. The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the attacker-controlled domain and subsequently download the malicious content. This vulnerability has a high impact on the confidentiality and integrity of the application, with no effect on the availability of the application.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Businessobjects Business Intelligence Platform

View all

CVE-2022-28213 HIGH This Week POC

8.1 Apr 12

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does n

CVE-2020-6242 CRITICAL Act Now

9.8 May 12

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an att

CVE-2020-6195 CRITICAL Act Now

9.8 Apr 14

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, l

CVE-2020-26831 CRITICAL Act Now

9.6 Dec 09

SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML

CVE-2024-28165 CRITICAL Act Now

9.3 May 14

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a par

CVE-2020-6308 MEDIUM This Month POC

5.3 Oct 20

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated at

CVE-2023-24530 CRITICAL Act Now

9.1 Feb 14

SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to uplo

CVE-2020-6294 CRITICAL Act Now

9.1 Aug 12

Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any

CVE-2023-0022 HIGH This Week

8.8 Jan 10

SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious

CVE-2022-35228 HIGH This Week

8.8 Jul 12

SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would ot

CVE-2020-6219 HIGH This Week

8.8 Apr 14

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Repo

CVE-2019-0398 HIGH This Week

8.8 Dec 11

Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all

CVE-2017-1000117 HIGH POC

8.8

CVE-2016-5385 HIGH POC

8.1

CVE-2017-3528 MEDIUM POC

5.4

CVE-2012-0518 MEDIUM

4.7

CVE-2024-21641 MEDIUM POC

6.5

CVE-2015-5354 MEDIUM POC

5.8

CVE-2024-22891 CRITICAL POC

9.8

CVE-2022-40083 CRITICAL POC

9.6

CVE-2026-0508 vulnerability details – vuln.today

Back

Businessobjects Business Intelligence Platform CVE-2026-0508

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Businessobjects Business Intelligence Platform

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

Share

External POC / Exploit Code