---
id: "CVE-2026-109798"
page: "https://infrastack.ai/live/CVE-2026-109798"
kind: "vulnerability"
aliases: ["CVE-2026-109798"]
title: "SAP BusinessObjects Web Intelligence: XML entity flaw exposes server files and internal systems"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SAP BusinessObjects Business Intelligence Platform (Web Intelligence)", "fixed": [], "affected": "ENTERPRISE 430, 2025, 2027", "ecosystem": "vendor"}]
ecosystems: []
tags: ["businessobjects", "sap", "self-hosted", "vendor", "web-intelligence", "xxe"]
not_affected_if: ["auth-required", "unknown"]
published_at: "2026-11-10T01:17:13+00:00"
first_seen_at: "2026-11-10T01:26:36+00:00"
updated_at: "2026-11-10T01:31:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109798", "first_seen_at": "2026-11-10T01:26:36+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-109798-xml-external-entity-xxe-vulnerability-in-sap", "first_seen_at": "2026-11-10T01:31:37+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-109798-xml-external-entity-xxe-vulnerability-in-sap"]}]
exploit_sources: []
---

# SAP BusinessObjects Web Intelligence: XML entity flaw exposes server files and internal systems

Link for people: https://infrastack.ai/live/CVE-2026-109798 (this .md is for agents)

SAP BusinessObjects Business Intelligence Platform's Web Intelligence component does not restrict external entity resolution when processing OLAP connection requests. An authenticated attacker can read sensitive files on the server and reach internal systems that are not otherwise exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP BusinessObjects Business Intelligence Platform (Web Intelligence) affected ENTERPRISE 430, 2025, 2027 fixed no fixed version listed

## How to check

Check your BusinessObjects BI Platform release (Central Management Console > Properties, or CMC About) against ENTERPRISE 430, 2025 and 2027 (the versions listed in the CVE record), then open SAP note 3799117 in SAP for Me for the exact fixed support packages/patches. Also check whether Web Intelligence is enabled and who has accounts able to create OLAP connections.

## Fix

Apply the correction in SAP Security Note 3799117 (November 2026 Patch Day). Exact fixed patch levels not read: see the note in SAP for Me.

## Timeline

- 2026-11-10T01:26:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109798
- 2026-11-10T01:31:37+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-109798-xml-external-entity-xxe-vulnerability-in-sap — SAP security note 3799117 (me.sap.com, login required, not read) is the primary source; Nov 2026 Patch Day page not retrievable. Affected per CVE record mirror: BI Platform ENTERPRISE 430, 2025, 2027; fixed patch levels unknown. Nothing verified; no exploitation or PoC found. Settle by reading note 3799117 in SAP for Me.

## Documents

- [describes] HOL Guard record for CVE-2026-109798 (mirrors CVE list) https://hol.org/guard/security/cves/CVE-2026-109798-xml-external-entity-xxe-vulnerability-in-sap

## From the sources

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_