CVE-2026-0485

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0485", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2025-12-09T22:06:29.196Z", "datePublished": "2026-02-10T03:00:49.421Z", "dateUpdated": "2026-02-10T15:13:19.015Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP BusinessObjects BI Platform", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.</p>"}], "value": "SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-405", "description": "CWE-405: Asymmetric Resource Consumption", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:00:49.421Z"}, "references": [{"url": "https://me.sap.com/notes/3678282"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T15:13:09.130841Z", "id": "CVE-2026-0485", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:13:19.015Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0485", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T15:13:09.130841Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:13:13.097Z"}}], "cna": {"title": "Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP BusinessObjects BI Platform", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3678282"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-405", "description": "CWE-405: Asymmetric Resource Consumption"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:00:49.421Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0485", "state": "PUBLISHED", "dateUpdated": "2026-02-10T15:13:19.015Z", "dateReserved": "2025-12-09T22:06:29.196Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-02-10T03:00:49.421Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP BusinessObjects BI Platform", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:enterprise:*:*:*", "matchCriteriaId": "8354981E-4A5F-4E5E-AF3A-283D5922DF90", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2025:*:*:*:enterprise:*:*:*", "matchCriteriaId": "CEEB4426-D0A6-40D4-B053-8A47E8E0700D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2027:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C532D05D-B06C-4BAB-84D1-5127F3A78977", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected."}, {"lang": "es", "value": "SAP BusinessObjects BI Platform permite a un atacante no autenticado enviar solicitudes especialmente dise\u00f1adas que podr\u00edan causar que el Content Management Server (CMS) se bloquee y se reinicie autom\u00e1ticamente. Al enviar repetidamente estas solicitudes, el atacante podr\u00eda inducir una interrupci\u00f3n persistente del servicio, dejando el CMS completamente no disponible. La explotaci\u00f3n exitosa resulta en un alto impacto en la disponibilidad, mientras que la confidencialidad y la integridad no se ven afectadas."}], "id": "CVE-2026-0485", "lastModified": "2026-06-17T10:10:49.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0485", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T15:13:09.130841Z", "version": "2.0.3"}}]}, "published": "2026-02-10T04:16:01.387", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3678282"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-405"}], "source": "cna@sap.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "ENTERPRISE 430"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2025"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2027"}}], "product": "businessobjects_bi_platform", "vendor": "sap"}], "analysis": {"en": {"generated_at": "2026-04-17T21:02:02.203520+00:00", "value": {"mitigation_remediation": ["Apply the latest patch for SAP BusinessObjects BI Platform as provided in SAP Security Patch Day (see note\u00a03678282).", "If patching cannot occur immediately, restrict external access to the Content Management Server by configuring firewall rules to allow only trusted IP addresses.", "Configure alerts and monitor system logs for repeated request patterns or abnormal traffic that may indicate an ongoing denial\u2011of\u2011service attempt."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected product is SAP BusinessObjects BI Platform. Version information inferred from the listed CPE entries indicates the vulnerability exists in the 2025, 2027, and 430 Enterprise editions of the platform. No other versions are explicitly identified as affected.", "description_and_impact": "SAP BusinessObjects BI Platform exposes a Content Management Server component that can be targeted by an unauthenticated attacker through specially crafted requests. These requests trigger a crash, causing the server to automatically restart. When the attacker repeats the attack, the CMS can be forced into a repeated crash\u2011restart loop, leading to a persistent outage. The vulnerability has a high impact on availability, while confidentiality and integrity remain unaffected.", "risk_and_exploitability": "The CVSS score of 7.5 classifies this defect as high severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not part of the CISA known exploited vulnerabilities catalog. Attackers can exploit the flaw remotely with no authentication, from any network able to reach the CMS endpoints. Successful exploitation results in denial of service and prolonged unavailability of the platform."}}}}, "created": "2026-02-10T15:37:22.958898+00:00", "updated": "2026-04-17T21:15:27.372884+00:00", "vendors": ["sap", "sap$PRODUCT$businessobjects_bi_platform"]}