CVE-2026-109798

Summary

SAP BusinessObjects Web Intelligence improperly allows external entity resolution during OLAP connection processing, enabling authenticated attackers to read sensitive server files and access internal systems via XXE (XML External Entity) abuse. This violates isolation boundaries and leads to significant data exposure.

Exploitability

Requires valid authentication and the ability to submit malicious OLAP connection requests that trigger XML parsing with external entity resolution enabled.

Blast radius

Successful exploitation allows attackers to exfiltrate sensitive server-side files (e.g., credentials, configuration) and pivot into internal networks otherwise protected from direct external access.

Detection

Monitor Web Intelligence server logs for XML parsing errors related to external entity resolution (e.g., 'EntityReference: unable to resolve external entity' or 'SAXParseException: External entity not found'), and correlate with unusual outbound connections from the BI server to internal resources or file systems during OLAP session initiation.

Prioritized remediation

Upgrade to SAP BusinessObjects BI Platform patch level 4.3 SP05 Patch 12 or later (SAP Note 3378917); if immediate patching is not feasible, disable OLAP connection features or restrict network access to the Web Intelligence server to trusted sources only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.