CVE-2026-66763 — Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)

Description (CNA)

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP BusinessObjects Business Intelligence Platform (Central Management Server)	affected ENTERPRISE 430; affected 2025; affected 2027

CWE

CWE-321

References

https://me.sap.com/notes/3756565
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.