BusinessObjects Web Intelligence XXE: CVE-2026-109798 · CVSS 3.0 9.1 · SAP Note 3799117
Note 3799117 fixes XML external entity handling in SAP BusinessObjects BI Platform (Web Intelligence). Specifically, the problem occurs when the platform processes OLAP connection requests. An authenticated user could include entities that make the server read local files. Moreover, the server could send requests to internal systems that are otherwise unreachable. SAP rates the BusinessObjects Web Intelligence XXE at CVSS 9.1 with HotNews priority. In this post, we cover exposure, the fix and what to check.
BusinessObjects Web Intelligence XXE: affected versions
The note covers BI Platform 4.3 (ENTERPRISE 430) as well as the 2025 and 2027 releases. The fix for this issue tightens XML processing. In addition, it adds stricter validation of OLAP connection parameters. See SAP KBA 3839332 for the FAQ and KBA 2144559 for the BI maintenance schedule.
Why SAP rates it so high
This issue is more than a file read. For example, server configuration often holds database and CMS credentials. Furthermore, the BI host typically has network paths to data warehouses and ERP systems. The changed scope in the CVSS vector reflects that reach.
What to do
Apply the support package or patch for your BI release, since SAP lists no workaround for the BusinessObjects Web Intelligence XXE. Meanwhile, review which users can create or edit OLAP connections in Web Intelligence. Then restrict that right to the people who really need it.
Detection after patching
After patching, check web tier logs for OLAP connection requests with DOCTYPE declarations. Similarly, review outbound connections from the BI host to unusual internal targets. Both can reveal earlier attempts to exploit the BusinessObjects Web Intelligence XXE.
BusinessObjects Web Intelligence XXE: advisory details
Component: BI-BIP-SL
SAP priority: HotNews
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Source: SAP Security Note 3799117 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
