CVE-2026-0508 Open Redirect vulnerability in SAP BusinessObjects Business Intelligence Platform

High 7.3 Published 10 Feb 2026 Updated 26 Feb 2026

An authenticated high-privilege attacker can insert malicious URLs causing unvalidated redirects, leading to potential data exposure and integrity loss.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-0508?

CVE-2026-0508 is a high-severity vulnerability in Sap Businessobjects Business Intelligence Platform, published on 10 Feb 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the attacker-controlled domain and subsequently download the malicious content. This vulnerability has a high impact on the confidentiality and integrity of the application, with no effect on the availability of the application.

Weakness: CWE-601

Which versions are affected by CVE-2026-0508?

It affects 1 product.

Products include Sap Businessobjects Business Intelligence Platform.

How do I fix CVE-2026-0508?

No fix has been published for CVE-2026-0508 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-0508 being exploited?

There is no known exploitation of CVE-2026-0508 in the wild and no public exploit code.

All Sap Businessobjects Business Intelligence Platform vulnerabilities

Sources

Also known as GHSA-fj5w-23f4-pvw6.