CVE-2026-0490

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on the availability but no impact on the confidentiality and integrity.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP BusinessObjects BI Platform	ENTERPRISE 430; 2025; 2027

References

https://me.sap.com/notes/3654236Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-04919.1SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. Thi CVE-2026-04928.8SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user po CVE-2026-04934.3Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute stat CVE-2026-04944.3Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would CVE-2026-04955.1SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which CVE-2026-04966.6SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) witho CVE-2026-04974.3SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This CVE-2026-04987.2SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module expose CVE-2026-04996.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect CVE-2026-05008.8Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker co CVE-2026-05019.9Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could ex CVE-2026-05025.4Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could be tricked by an atta