CVE-2026-0508
CVE-2026-0508 is a high-severity vulnerability in Sap Businessobjects Business Intelligence Platform with a CVSS 3.x base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-601.
Key facts
- Severity: High (CVSS 3.x base score 7.3)
- EPSS exploit prediction: 0% (20th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-6388
- Weakness: CWE-601
- Affected product: Sap Businessobjects Business Intelligence Platform
- Published:
- Last modified:
Description
The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the attacker-controlled domain and subsequently download the malicious content. This vulnerability has a high impact on the confidentiality and integrity of the application, with no effect on the availability of the application.
Frequently asked questions
- What is CVE-2026-0508?
- The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the attacker-controlled domain and subsequently download the malicious content. This vulnerability has a high impact on the confidentiality and integrity of the application, with no effect on the availability of the application.
- How severe is CVE-2026-0508?
- CVE-2026-0508 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is high, integrity high, and availability none.
- Is CVE-2026-0508 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-0508?
- CVE-2026-0508 primarily affects Sap Businessobjects Business Intelligence Platform. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2026-0508?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-0508 have an EU (EUVD) identifier?
- Yes. CVE-2026-0508 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-6388.
- When was CVE-2026-0508 published?
- CVE-2026-0508 was published on 2026-02-10 and last updated on 2026-06-17.
References
Affected products (3)
- cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:enterprise:*:*:*
- cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2025:*:*:*:enterprise:*:*:*
- cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2027:*:*:*:enterprise:*:*:*
More vulnerabilities in Sap Businessobjects Business Intelligence Platform
- CVE-2023-0018 — Critical (CVSS 10.0): Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC…
- CVE-2023-0022 — Critical (CVSS 9.9): SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject…
- CVE-2020-6242 — Critical (CVSS 9.8): SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an…
- CVE-2020-6195 — Critical (CVSS 9.8): SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response,…
- CVE-2020-26831 — Critical (CVSS 9.6): SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML…
- CVE-2020-6294 — Critical (CVSS 9.1): Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any…
All CVEs affecting Sap Businessobjects Business Intelligence Platform →
Other CWE-601 (Open Redirect) vulnerabilities
- CVE-2018-3774 — Critical (CVSS 10.0): Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open…
- CVE-2019-25282 — Critical (CVSS 9.8): V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to…
- CVE-2020-36912 — Critical (CVSS 9.8): Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script…
- CVE-2025-43526 — Critical (CVSS 9.8): This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac…
- CVE-2025-55031 — Critical (CVSS 9.8): Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An…
- CVE-2024-22891 — Critical (CVSS 9.8): Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.