CVE-2026-0485 Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform

High 7.5 Published 10 Feb 2026 Updated 10 Feb 2026

Unauthenticated attackers can crash the Content Management Server via crafted requests, causing persistent service disruption in SAP BusinessObjects BI Platform.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-0485?

CVE-2026-0485 is a high-severity denial of service vulnerability in Sap Businessobjects Business Intelligence Platform, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.

Weakness: CWE-405

Which versions are affected by CVE-2026-0485?

It affects 1 product.

Products include Sap Businessobjects Business Intelligence Platform.

How do I fix CVE-2026-0485?

No fix has been published for CVE-2026-0485 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-0485 being exploited?

There is no known exploitation of CVE-2026-0485 in the wild and no public exploit code.

All Sap Businessobjects Business Intelligence Platform vulnerabilities

Sources

Also known as GHSA-97xg-2mgm-r8gr.