InfoSol We're passionate about inspired business intelligence
SAP issues monthly Security Patch Day Bulletins on the second Tuesday of every month. These have been synchronized with the Security Patch Day of other major software vendors. This month’s bulletin was issued on August 11 and contains 28 new security notes. Three of these notes apply to the SAP BusinessObjects platform and are described in this article.
CVE-2026-66763
For more information, review SAP Security Note 3687096 – [CVE-2026-66763] Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server) or the original CVE-2026-66763 record.
SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.
This vulnerability has a score of 7.9/10 on the Common Vulnerability Scoring System (CVSS) and is classified as high. It is fixed in the following releases:
-
SAP BusinessObjects BI 4.3 SP5 Patch 7 (released July 10, 2026)
-
SAP BusinessObjects BI 2025 SP0 Patch 12 (released July 10, 2026)
-
SAP BusinessObjects BI 2027 SP0 Patch 0 (Q1 2027)
CVE-2026-58248
For more information, review SAP Security Note 3753141 – [CVE-2026-58248] XML External Entity Injection in SAP BusinessObjects Business Intelligence or the original CVE-2026-58248 record.
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.
This vulnerability has a score of 6.5/10 on the Common Vulnerability Scoring System (CVSS) and is classified as medium. It is fixed in the following releases:
-
SAP BusinessObjects BI 4.3 SP5 Patch 7 (released July 10, 2026)
-
SAP BusinessObjects BI 2025 SP0 Patch 11 (released May 29, 2026)
-
SAP BusinessObjects BI 2027 SP0 Patch 0 (Q1 2027)
CVE-2026-66772
For more information, review SAP Security Note 3753141 – [CVE-2026-66772] Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools) or the original CVE-2026-66772 record.
SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. This results in a low impact on confidentiality. There is no impact on integrity and availability.
This vulnerability has a score of 4.3/10 on the Common Vulnerability Scoring System (CVSS) and is classified as medium. It is fixed in the following releases:
-
SAP BusinessObjects BI 4.3 SP5 Patch 6 (released May 22, 2026)
-
SAP BusinessObjects BI 2025 SP0 Patch 12 (released July 10, 2026)
-
SAP BusinessObjects BI 2027 SP0 Patch 0 (Q1 2027)
SAP Knowledge Base Articles worth Sharing
During their testing, SAP may determine that a particular CVE does not apply to the SAP BusinessObjects platform. These CVE are documented in the knowledge base articles below. You’ll want to share these with your SAP BusinessObjects and security teams. Hyperlinks are provided to specific KB articles regarding specific CVE.
BI 4.2 / 4.3 / 2025 / 2027 – Fixed CVE and Vulnerabilities List
SAP maintains a comprehensive list of fixed vulnerabilities by version and support pack in SAP KB 3069036 – BI 4.2 / 4.3 / 2025 / 2027 – Fixed CVE and Vulnerabilities List.
SAP JVM Vulnerabilities (CVE) NOT impacting SAP BI Platform
SAP uses its own JVM on the server side, not Oracle’s. SAP Note 2474924 – SAP JVM Vulnerabilities (CVE) NOT impacting SAP BI Platform (last updated August 9, 2026) details which CVE have been determined to have no impact on the SAP BusinessObjects platform.
Apache Tomcat vulnerabilities NOT impacting SAP BI Platform
When your organization’s security team identifies vulnerabilities in Apache Tomcat, you’ll want to review SAP Note 2498770 – Tomcat vulnerabilities (CVE-*) NOT impacting SAP BI Platform (last updated July 21, 2026) to provide documentation that patching is not needed for the SAP BI Platform.
Third-party software vulnerabilities NOT impacting SAP BusinessObjects
The SAP BusinessObjects platform uses multiple third-party software products. In addition to the list above for Apache Tomcat, review SAP Note 2914574 – Third-party software vulnerabilities (CVE) NOT impacting SAP BusinessObjects (last updated August 10, 2026) to provide documentation that a patch is not needed for the SAP BI Platform.
Recommendation
As a side benefit (and possibly to resolve vulnerabilities) both SAP BI 4.3 SP5 Patch 7 and BI 2025 SP0 Patch 12 update Apache Tomcat from version 9.0.111 to 9.0.118. SAP BI 2025 SP0 Patch 12 has a defect that prevents named users from being authenticated (SAP KB 3789152), so BI 2025 customers might want to wait for Patch 13, which is scheduled to arrive in two weeks. InfoSol has not yet installed BI 4.3 SP5 Patch 7. As always, review SAP’s release notes and patch upgrade guide, which are available on the SAP Help Portal.
Whether you patch BI 4.3 or move up to BI 2025 will largely be determined by whether your organization still uses “classic” UNV universes. These universes are no longer supported in BI 2025 and must be converted to UNX format prior to upgrading to BI 2025. Choosing BI 4.3 or BI 2025 also depends on the age of your hardware and operating system, as many organizations adopting BI 2025 will likely want to deploy it on new hardware using the latest supported version of Windows Server.
IMPORTANT: Support packs prior to BI 4.3 SP5 are no longer under patch support. Customers on BI 4.3 SP4 and earlier (this includes SAP BusinessObjects BI 4.2) should consider patching, as earlier versions are affected by security vulnerabilities.
IMPORTANT: InfoSol does not recommend BI 4.3 SP5 Patch 4 or BI 2025 SP0 Patch 8, as these patch levels were affected by a CMS clustering issue described in SAP Note 3724948.
InfoBurst
InfoSol also recommends that its InfoBurst customers use this opportunity to upgrade to InfoBurst 2026.2 after sufficient testing. InfoBurst software can be downloaded from the InfoSol Help Portal.
Previous SAP Security articles from SpeakBO
How InfoSol Can Help
Organizations running SAP BusinessObjects today face more than monthly patch decisions. They must balance security, platform support timelines, infrastructure modernization, and future upgrade paths. Whether you’re determining the right patch strategy for BI 4.3, evaluating a move to BI 2025, or preparing legacy UNV universes for conversion to UNX, InfoSol can help you build a practical roadmap that minimizes risk and avoids costly surprises. Contact InfoSol today to discuss your environment and create a strategy that keeps your BusinessObjects platform secure, supported, and ready for the future.
Contact InfoSol today to schedule a free patching assessment or upgrade consultation—and ensure your BI environment stays protected, optimized, and compliant.
