CVE-2026-66763

{
  "id": "CVE-2026-66763",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T01:17:23.000",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability."
    },
    {
      "lang": "es",
      "value": "SAP BusinessObjects Business Intelligence Platform almacena ciertas credenciales sensibles asociadas con objetos de usuario utilizando una clave criptográfica codificada de forma rígida. Un atacante con privilegios elevados y acceso local al servidor podría recuperar estos objetos y descifrar las credenciales almacenadas. La explotación exitosa podría permitir al atacante obtener datos de autenticación sensibles y modificar información protegida, lo que resultaría en un alto impacto en la confidencialidad y la integridad. No hay impacto en la disponibilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP BusinessObjects Business Intelligence Platform (Central Management Server)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "ENTERPRISE 430",
              "status": "affected"
            },
            {
              "version": "2025",
              "status": "affected"
            },
            {
              "version": "2027",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 7.9,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T13:17:06.267348Z",
          "id": "CVE-2026-66763",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3756565",
      "source": "[email protected]"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]"
    }
  ]
}