CVE-2026-58248: SAP SE SAP Businessobjects Business Intelligence

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.

Affected products

• SAP SE SAP Businessobjects Business Intelligence: version 2025 only; version 2027 only

Published 2026-08-11. Last modified 2026-08-26.