EUVD-2026-55880
GHSA-jwqg-65mh-q989
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Local access and high privileges required to reach the CMS store; scope change justified because recovered credentials enable compromise of connected external systems.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.
AnalysisAI
SAP BusinessObjects Business Intelligence Platform (Central Management Server) protects user credential objects with a hard-coded cryptographic key, enabling a high-privileged local attacker to retrieve those objects and decrypt their contents. Affected versions include ENTERPRISE 430, 2025, and 2027 of the CMS component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) local access to the SAP BusinessObjects Central Management Server host - not remote network access - meaning the attacker must have an OS-level shell or equivalent foothold on the server itself; and (2) high privileges sufficient to read the CMS credential object store, consistent with CVSS PR:H, such as CMS administrator or OS DBA permissions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.9 score reflects S:C (scope change), C:H, and I:H, but the AV:L (local) and PR:H (high privileges) prerequisites materially reduce the attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch documented in SAP Security Note 3756565, accessible via the SAP Support Portal at https://me.sap.com/notes/3756565. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all SAP BusinessObjects CMS installations running ENTERPRISE versions 430, 2025, or 2027; immediately restrict local operating system access to CMS servers to essential personnel only and audit current access logs for unauthorized activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today