CVE-2026-24324

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24324", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-01-21T22:15:36.672Z", "datePublished": "2026-02-10T03:04:21.162Z", "dateUpdated": "2026-02-10T16:17:50.858Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP BusinessObjects Business Intelligence Platform (AdminTools)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable and resulting in the denial of service of the Content Management Server (CMS). Successful exploitation impacts system availability, while confidentiality and integrity remain unaffected.</p>"}], "value": "SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable and resulting in the denial of service of the Content Management Server (CMS). Successful exploitation impacts system availability, while confidentiality and integrity remain unaffected."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-405", "description": "CWE-405: Asymmetric Resource Consumption", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:04:21.162Z"}, "references": [{"url": "https://me.sap.com/notes/3695912"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T16:16:59.482962Z", "id": "CVE-2026-24324", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:17:50.858Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24324", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T16:16:59.482962Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:17:08.133Z"}}], "cna": {"title": "Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP BusinessObjects Business Intelligence Platform (AdminTools)", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3695912"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable and resulting in the denial of service of the Content Management Server (CMS). Successful exploitation impacts system availability, while confidentiality and integrity remain unaffected.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable and resulting in the denial of service of the Content Management Server (CMS). Successful exploitation impacts system availability, while confidentiality and integrity remain unaffected.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-405", "description": "CWE-405: Asymmetric Resource Consumption"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:04:21.162Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24324", "state": "PUBLISHED", "dateUpdated": "2026-02-10T16:17:50.858Z", "dateReserved": "2026-01-21T22:15:36.672Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-02-10T03:04:21.162Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP BusinessObjects Business Intelligence Platform (AdminTools)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "ENTERPRISE 430"}, {"status": "affected", "version": "2025"}, {"status": "affected", "version": "2027"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:enterprise:*:*:*", "matchCriteriaId": "8354981E-4A5F-4E5E-AF3A-283D5922DF90", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2025:*:*:*:enterprise:*:*:*", "matchCriteriaId": "CEEB4426-D0A6-40D4-B053-8A47E8E0700D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2027:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C532D05D-B06C-4BAB-84D1-5127F3A78977", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable and resulting in the denial of service of the Content Management Server (CMS). Successful exploitation impacts system availability, while confidentiality and integrity remain unaffected."}, {"lang": "es", "value": "SAP BusinessObjects Business Intelligence Platform (AdminTools) permite a un atacante autenticado con privilegios de usuario ejecutar una consulta espec\u00edfica en AdminTools que podr\u00eda causar la ca\u00edda del Content Management Server (CMS), dejando el CMS parcial o completamente no disponible y resultando en la denegaci\u00f3n de servicio del Content Management Server (CMS). La explotaci\u00f3n exitosa afecta la disponibilidad del sistema, mientras que la confidencialidad y la integridad no se ven afectadas."}], "id": "CVE-2026-24324", "lastModified": "2026-06-17T10:22:54.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24324", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T16:16:59.482962Z", "version": "2.0.3"}}]}, "published": "2026-02-10T04:16:04.630", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3695912"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-405"}], "source": "cna@sap.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "ENTERPRISE 430"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2025"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2027"}}], "product": "sap_business_objects_business_intelligence_platform", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-17T20:55:34.254906+00:00", "value": {"mitigation_remediation": ["Apply the security patch referenced in SAP Note\u00a03695912 or the latest SAP Security Patch Day release to update the AdminTools component of SAP BusinessObjects Business Intelligence Platform", "Restrict or remove user privileges for executing the vulnerable query in AdminTools, limiting this capability to trusted administrators only", "Continuously monitor CMS logs for unexpected crashes or repeated DoS attempts and audit access controls to ensure that privilege restrictions remain effective"], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "SAP SE\u2019s SAP BusinessObjects Business Intelligence Platform (AdminTools) for the 2025, 2027, and 430 enterprise releases are affected. These versions run on the enterprise edition and the problem is present across all supported operating environments for those releases.", "description_and_impact": "This vulnerability exists in the AdminTools component of SAP BusinessObjects Business Intelligence Platform. An authenticated user with standard privileges can submit a specially crafted query that causes the Content Management Server to crash, making the CMS unavailable. The flaw is identified as CWE\u2011405, reflecting improper handling of input that can trigger an application crash.", "risk_and_exploitability": "The CVSS base score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, although the vulnerability is not listed in the CISA KEV catalog. An attacker must first be authenticated with normal user rights to execute the vulnerable query, so the attack vector is local or internal. Successful exploitation would result in a denial of service to the Content Management Server, affecting availability while leaving confidentiality and integrity unchanged."}}}}, "created": "2026-02-10T15:37:15.261332+00:00", "updated": "2026-04-17T21:00:12.720209+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_business_objects_business_intelligence_platform"]}