BusinessObjects Struts DoS: CVE-2026-73635 · CVSS 3.0 5.3 · SAP Note 3803144
Note 3803144 addresses the Apache Struts component inside SAP BusinessObjects BI Platform. With Struts 6.8, a user with limited access could send requests that consume excessive memory. As a result, the platform could become unavailable. However, the attacker needs to know specific internal identifiers. That keeps the BusinessObjects Struts DoS at CVSS 5.3, Medium. In this post, we cover exposure, the fix and what to check.
BusinessObjects Struts DoS: fix
The BusinessObjects Struts DoS affects BI 4.3, 2025 and 2027 (ENTERPRISE and ENTERPRISECLIENTTOOLS). SAP upgrades Struts to 6.11 and redirects the affected endpoint to an error page. So apply the support package or patch, and see KBA 2144559 for the BI maintenance schedule.
Related
Plan the fix together with Note 3799117, the 9.1 XXE in Web Intelligence. After all, both need a BI patch. In addition, one combined rollout means only one maintenance window for the BI platform.
Why third-party libraries matter
BI Platform ships many open source libraries, and each one brings its own bugs. Therefore, this issue is a reminder that BI patches are also library updates. Staying on a current patch level keeps those libraries current too.
What to check
First, confirm the BI patch level on every node of the cluster. Next, monitor memory use of the web tier, because sudden growth can point to attempts at this attack. Finally, after patching, check that the affected endpoint returns an error page.
BusinessObjects Struts DoS: advisory details
Component: BI-BIP-CMC
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 7
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: SAP Security Note 3803144 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
