CVE-2026-44755: SAP Business Objects Email Spoofing Flaw

CVE-2026-44755 Overview

CVE-2026-44755 is an email spoofing vulnerability in SAP Business Objects Business Intelligence Platform. The platform fails to sufficiently validate email sending parameters supplied by authenticated users. An attacker with valid low-privilege credentials can manipulate these parameters to send messages that appear to originate from trusted senders. The flaw is categorized under [CWE-346] Origin Validation Error.

The vulnerability has a low impact on integrity and does not affect the confidentiality or availability of the application. Successful exploitation enables phishing campaigns, social engineering attacks, and brand impersonation that abuse the trust associated with internal SAP communications.

Critical Impact
Authenticated users can spoof email parameters to send messages that impersonate trusted senders, enabling phishing and social engineering attacks against recipients who trust SAP-originated mail.

Affected Products

SAP Business Objects Business Intelligence Platform

Discovery Timeline

2026-06-09 - CVE-2026-44755 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-44755

Vulnerability Analysis

The vulnerability resides in the email handling subsystem of SAP Business Objects Business Intelligence Platform. The platform accepts email sending parameters from authenticated users without enforcing sufficient validation on sender-related fields. An attacker can supply crafted values for parameters such as the From address, Reply-To header, or display name when initiating mail operations through the platform.

Because the platform forwards these parameters to the mail transport layer without canonical checks against the authenticated identity, recipients see messages that appear to originate from a different sender. Phishing payloads delivered this way bypass user suspicion because they carry SAP-originated infrastructure characteristics.

The issue requires authentication and network access to the application. No user interaction is required on the victim side beyond reading the spoofed mail. The integrity impact is limited to message authenticity, but the downstream consequences include credential theft and fraud through targeted phishing.

Root Cause

The root cause is missing origin validation [CWE-346]. The platform trusts user-supplied email metadata instead of binding outgoing messages to the authenticated session identity. Sender fields should be derived from server-side identity context, not from client input.

Attack Vector

An authenticated attacker submits an email send request through the Business Intelligence Platform interface or API. The attacker supplies a forged sender address or display name. The platform constructs the outbound SMTP message using these values and dispatches it through configured mail relays. Recipients receive a message that appears legitimate and may be Domain Keys Identified Mail (DKIM) signed by the SAP infrastructure, increasing deliverability and perceived trust.

The vulnerability mechanism is described in prose because no verified proof-of-concept code is publicly available. Refer to SAP Note #3687096 for vendor technical details.

Detection Methods for CVE-2026-44755

Indicators of Compromise

Outbound mail from SAP Business Objects relays containing From or Reply-To headers that do not correspond to the authenticated SAP user that initiated the send operation.
Unusual volumes of email send requests originating from a single Business Intelligence Platform user account.
Recipient reports of suspicious messages bearing internal sender addresses that the legitimate sender did not send.

Detection Strategies

Correlate SAP Business Objects audit logs of email send actions with SMTP relay logs to identify mismatches between authenticated user identity and message sender headers.
Inspect outbound mail flow for messages where the SAP-authenticated principal differs from the MAIL FROM or From header value.
Establish a baseline of normal email send patterns per user and alert on deviations in sender domain, recipient volume, or send frequency.

Monitoring Recommendations

Enable detailed auditing of scheduled and ad-hoc report distribution events within the Business Intelligence Platform.
Forward SAP Business Objects logs and mail gateway logs to a centralized analytics platform for correlation.
Monitor Domain-based Message Authentication, Reporting and Conformance (DMARC) failure reports for spoofed messages claiming SAP-related sender domains.

How to Mitigate CVE-2026-44755

Immediate Actions Required

Apply the vendor patch referenced in SAP Note #3687096 as soon as your patch testing cycle permits.
Review authenticated user accounts with email send privileges and remove access for accounts that do not require it.
Audit recent outbound mail from the Business Intelligence Platform for signs of sender spoofing.

Patch Information

SAP released the fix as part of SAP Security Patch Day. Customers must download and apply the corrections referenced in SAP Note #3687096. Additional advisory context is available on the SAP Security Patch Day portal.

Workarounds

Restrict the set of accounts authorized to send email or schedule mail-enabled report distributions to a minimum.
Enforce strict Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and DMARC policies on SAP sender domains to limit spoofing impact on recipients.
Configure the mail relay to rewrite or validate From headers against the authenticated SAP user identity before message dispatch.

bash

# Example DMARC reject policy to limit spoofing damage on the SAP domain
# Add this TXT record at _dmarc.example.com
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; adkim=s; aspf=s