---
cve: "CVE-2026-66763"
severity: "HIGH"
cvss: 7.9
epss: "0.2%"
vendor: "SAP_SE"
kev: false
exploited: false
published: "2026-08-11 01:17:23"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T12:36:14+01:00"
---

# CVE-2026-66763

> 7.9 HIGH

## Beschreibung

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

## CNA-Record (Kanon, cvelistV5)

- CNA: **sap**
- State: PUBLISHED
- Stand: 2026-08-11 14:29:02
- CNA-CVSS: **7.9** (`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Hoch | good |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-321** — Use of Hard-coded Cryptographic Key
  The product uses a hard-coded, unchangeable cryptographic key.

## BSI-Hinweise (deutsch)

- [SAP Patch Day August 2026: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-2746) — _BSI-Einstufung: kritisch_
  Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen oder Anmeldedaten offenzulegen, Daten zu manipulieren, SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuführen oder einen Denial-of-Service-Zustand herbeizuführen.

## Referenzen

- <https://me.sap.com/notes/3756565>
- <https://url.sap/sapsecuritypatchday>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-66763/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_