EUVD-2026-55880
GHSA-jwqg-65mh-q989
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Local access and high privileges required to reach the CMS store; scope change justified because recovered credentials enable compromise of connected external systems.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.
AnalysisAI
SAP BusinessObjects Business Intelligence Platform (Central Management Server) protects user credential objects with a hard-coded cryptographic key, enabling a high-privileged local attacker to retrieve those objects and decrypt their contents. Affected versions include ENTERPRISE 430, 2025, and 2027 of the CMS component. No public exploit or active exploitation has been identified at time of analysis, but the CVSS scope change (S:C) signals that successfully decrypted credentials can be used to compromise systems beyond the BI platform itself.
Technical ContextAI
CWE-321 (Use of Hard-coded Cryptographic Key) describes the root cause: the application embeds a fixed, static key in its binary to encrypt sensitive credential data associated with user objects in the Central Management Server. Because the key is hard-coded rather than derived from a per-installation secret or HSM, any attacker who can access the stored credential objects and locate the key in the application binaries - through reverse engineering or published research - can decrypt them without guessing or brute-forcing. The affected component per CPE (cpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform_(central_management_server):*:*:*:*:*:*:*:*) is the CMS, which serves as the central repository for user accounts, authentication data, and permissions within the SAP BO ecosystem. The CMS database therefore represents a high-value target for insider threats and compromised privileged accounts.
RemediationAI
Apply the patch documented in SAP Security Note 3756565, accessible via the SAP Support Portal at https://me.sap.com/notes/3756565. SAP's Security Patch Day page (https://url.sap/sapsecuritypatchday) provides broader patch-cycle context. While exact patched version numbers are not independently confirmed from available data beyond the SAP advisory, the note covers ENTERPRISE 430, 2025, and 2027 lines. As compensating controls pending patching: restrict local OS-level and database-level access to the CMS host to only those accounts that operationally require it - this directly limits the PR:H+AV:L attack path. Audit privileged account membership on CMS servers and enable logging of access to the CMS credential store. Force rotation of all credentials stored in the CMS after patching to invalidate any that may have been previously decrypted. These controls carry the trade-off of increased operational overhead for legitimate admin workflows.
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today