CVE-2026-66763: SAP BusinessObjects Information Disclosure

CVE-2026-66763 Overview

CVE-2026-66763 is a hard-coded cryptographic key vulnerability [CWE-321] in SAP BusinessObjects Business Intelligence Platform. The platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server can retrieve these objects and decrypt the stored credentials. Successful exploitation allows the attacker to obtain sensitive authentication data and modify protected information. The vulnerability produces high impact on confidentiality and integrity, with no impact on availability.

Critical Impact
A local attacker with high privileges can decrypt stored user credentials, leading to authentication data disclosure and unauthorized modification of protected information.

Affected Products

SAP BusinessObjects Business Intelligence Platform
User object credential storage subsystem
Deployments referenced by SAP Note #3756565

Discovery Timeline

2026-08-11 - CVE-2026-66763 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-66763

Vulnerability Analysis

SAP BusinessObjects Business Intelligence Platform protects sensitive credentials tied to user objects with symmetric encryption. The encryption relies on a cryptographic key embedded directly in the product code or configuration. Because the key is static and shared across installations, it does not act as a secret. An attacker with local server access and elevated privileges can locate the encrypted credential blobs, apply the known key, and recover plaintext credentials.

The vulnerability is classified under [CWE-321: Use of Hard-coded Cryptographic Key]. The scope is marked as changed, meaning exploitation affects components beyond the vulnerable one. Recovered credentials may unlock downstream systems that BusinessObjects connects to, including database accounts and integrated authentication providers.

Root Cause

The root cause is the use of a hard-coded cryptographic key to protect user object credentials. Any actor able to read the ciphertext and reference the product binaries can derive the plaintext without additional secrets. Proper design requires per-installation or per-tenant keys stored in a protected key vault, rotated on a defined lifecycle, and separated from the encrypted data at rest.

Attack Vector

Exploitation requires local access to the BusinessObjects server and high privileges on the host or application. The attacker enumerates user objects containing encrypted credentials, extracts the ciphertext, and decrypts it using the hard-coded key recoverable from the platform binaries. No user interaction is required. Because the credentials often authenticate to secondary systems, the impact extends beyond the BusinessObjects host. See the SAP Note #3756565 and the SAP Security Patch Day advisory for vendor-specific technical details.

Detection Methods for CVE-2026-66763

Indicators of Compromise

Unexpected read access to BusinessObjects CMS repository files or user object exports by administrative accounts.
Presence of extraction tools, debuggers, or scripts referencing BusinessObjects encryption routines on the server.
Anomalous outbound authentication attempts using credentials that map to BusinessObjects data source or user objects.
Off-hours logins by privileged BusinessObjects service or OS accounts.

Detection Strategies

Monitor privileged file access to the BusinessObjects installation directory and CMS backing store.
Alert on process execution that loads BusinessObjects cryptographic libraries outside of the standard service context.
Correlate successful decryption of user object exports with subsequent authentication attempts against linked systems.

Monitoring Recommendations

Enable audit logging on the Central Management Server for user object read, export, and modification events.
Forward BusinessObjects and host operating system logs to a centralized SIEM for correlation across accounts and hosts.
Track privileged account activity and flag interactive sessions on BusinessObjects servers that fall outside change windows.

How to Mitigate CVE-2026-66763

Immediate Actions Required

Apply the security update referenced in SAP Note #3756565 as soon as it is validated in a test environment.
Rotate any credentials stored in BusinessObjects user objects, including data source and integration accounts.
Restrict local and administrative access to BusinessObjects servers to a minimal set of named accounts.
Review audit logs for prior privileged access to user object stores and export operations.

Patch Information

SAP has released a security update as part of SAP Security Patch Day. Administrators should consult SAP Note #3756565 for the specific patched versions, prerequisites, and installation instructions. Refer to the SAP Security Patch Day portal for advisory metadata and related fixes.

Workarounds

Limit operating system and application-level administrative privileges on BusinessObjects hosts to reduce the population of accounts that satisfy the exploitation preconditions.
Enforce network segmentation so that BusinessObjects servers are not directly reachable from general user workstations.
Enable file integrity monitoring on the BusinessObjects installation directory and CMS repository.
Rotate credentials referenced by user objects on a defined schedule until patching is complete.

bash

# Configuration example
# Restrict interactive logon on the BusinessObjects host to a defined admin group
# and enable auditing on the installation directory (Linux example)
chown -R sapadm:sapadm /opt/sap/businessobjects
chmod -R 750 /opt/sap/businessobjects
auditctl -w /opt/sap/businessobjects -p rwxa -k bo_access