SAP BusinessObjects CVE-2026-66772

Exploitation requires a valid, authenticated session with at least non-administrative (low-privilege) user credentials on the SAP BusinessObjects BI Platform - confirmed by CVSS PR:L. The vulnerability is network-reachable with no additional complexity (AV:N, AC:L, UI:N), meaning no special network position or user interaction is needed beyond authentication. Exploitation is limited to information disclosure only (C:L); no write access or service disruption is achievable through this flaw. Non-default configurations are not required - any deployment exposing the Admin Tools component to authenticated non-admin users is potentially affected. External unauthenticated attackers without valid credentials cannot exploit this directly.

CVSS signals a medium-low risk: network-reachable (AV:N), low complexity (AC:L), low-privilege authenticated access required (PR:L), no user interaction, unchanged scope, and only low confidentiality impact with no integrity or availability consequence. EPSS data was not provided in the input, so exploitation probability cannot be quantified. KEV status is absent, meaning active exploitation is not confirmed by CISA. No public proof-of-concept has been identified. The real-world priority is modest: while any authorization bypass in an enterprise admin interface warrants attention, the narrow impact - limited information disclosure with no write or denial-of-service path - constrains the blast radius. The authentication requirement (PR:L) also limits exposure to insiders or accounts already compromised. Defenders should patch on normal patch cycle cadence; there is no evidence supporting emergency treatment.

An attacker with a valid low-privilege account on the SAP BusinessObjects platform sends a crafted network request to an administrative endpoint that lacks a proper authorization check. The server returns restricted administrative information without verifying the caller's role, exposing configuration or operational details. No public exploit code is available, so exploitation currently requires manual discovery of the unprotected endpoints.