CVE-2026-0485

SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3678282	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430::::enterprise:::
	cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2025::::enterprise:::
	cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2027::::enterprise:::

History

No history.

Information

Published : 2026-02-10 04:16

Updated : 2026-02-17 16:11

NVD link : CVE-2026-0485

Mitre link : CVE-2026-0485

CVE.ORG link : CVE-2026-0485

JSON object : View

Products Affected

sap

businessobjects_business_intelligence_platform

CWE

CWE-405

Asymmetric Resource Consumption (Amplification)

NVD-CWE-noinfo

{"id": "CVE-2026-0485", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-02-10T04:16:01.387", "references": [{"url": "https://me.sap.com/notes/3678282", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-405"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected."}, {"lang": "es", "value": "SAP BusinessObjects BI Platform permite a un atacante no autenticado enviar solicitudes especialmente dise\u00f1adas que podr\u00edan causar que el Content Management Server (CMS) se bloquee y se reinicie autom\u00e1ticamente. Al enviar repetidamente estas solicitudes, el atacante podr\u00eda inducir una interrupci\u00f3n persistente del servicio, dejando el CMS completamente no disponible. La explotaci\u00f3n exitosa resulta en un alto impacto en la disponibilidad, mientras que la confidencialidad y la integridad no se ven afectadas."}], "lastModified": "2026-02-17T16:11:42.843", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "8354981E-4A5F-4E5E-AF3A-283D5922DF90"}, {"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2025:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "CEEB4426-D0A6-40D4-B053-8A47E8E0700D"}, {"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2027:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "C532D05D-B06C-4BAB-84D1-5127F3A78977"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}