SAP BusinessObjects Web Intelligence XXE lets authenticated attackers read server files (CVE-2026-109798)

What happened

The Web Intelligence component of SAP BusinessObjects Business Intelligence Platform does not properly restrict external entity resolution when processing OLAP connection requests. This is an XML External Entity (XXE) issue, classified as CWE-611. An attacker with low-privileged access can exploit it over the network; no user interaction is required. By submitting a crafted OLAP connection request, the attacker can cause the platform to resolve external entities, read sensitive files on the server, and reach internal systems that are not otherwise exposed. The CVE record rates the confidentiality impact as high and the integrity and availability impacts as low, with the effect extending beyond the vulnerable component. The CVE record does not show active exploitation or public disclosure.

Who is affected

SAP lists SAP BusinessObjects Business Intelligence Platform (Web Intelligence) ENTERPRISE 430, 2025 and 2027 as affected. If your organisation runs BusinessObjects BI Platform in any of these editions, confirm whether Web Intelligence is reachable over the network by authenticated users.

What to do now

No fixed version or workaround is listed in the CVE record for CVE-2026-109798. Until SAP publishes a fix, reduce the conditions that make exploitation possible.

1. Check SAP's security note for CVE-2026-109798 and monitor SAP Security Patch Day for a fix.
2. Treat Web Intelligence as an internal application; do not expose it directly to the internet unless strict access controls and additional inspection are in place.
3. Restrict network reach from the BI Platform to internal systems, so that successful entity resolution has less to reach.
4. Review and reduce Web Intelligence accounts, especially low-privileged accounts that do not need OLAP connection privileges.
5. When a fixed version is published, prioritise instances that accept network connections.

How to detect it

The CVE record does not provide indicators of compromise. As a general check, review Web Intelligence authentication and request logs for OLAP connection requests from accounts that do not normally create them, and monitor outbound connections from the BI Platform towards internal systems.

Beyond the patch

For SAP estates, this is less about a single patch and more about knowing where BusinessObjects and Web Intelligence are exposed and how quickly SAP's release cycle closes critical gaps. Our SAP security practice can help map your SAP and BusinessObjects estate and reduce exposure of reporting components. Because the exposure window is defined by SAP's patch cycle, Supply Chain Defense & Third-Party Risk work helps track this vendor exposure.