CVE-2026-66763: SAP BusinessObjects CMS Stores Credentials Behind a Hardcoded Cryptographic Key
SAP BusinessObjects BI Platform CMS encrypts sensitive credentials with a hardcoded cryptographic key baked into the source code. Anyone with high privileges and local server access can extract and decrypt every stored password.
Contents
CVE-2026-66763: SAP BusinessObjects CMS Stores Your Credentials Behind a Hardcoded Cryptographic Key
TL;DR: SAP BusinessObjects Business Intelligence Platform's Central Management Server encrypts sensitive credentials associated with user objects using a cryptographic key baked into the source code. Anyone with high privileges and local server access can extract those objects and decrypt every stored password. Fix it by applying SAP Note 3594149 and rotating every credential the platform has ever stored.
What happened
SAP BusinessObjects Business Intelligence Platform (Central Management Server) keeps certain sensitive credentials tied to user objects in its internal data store. The encryption protecting those credentials relies on a single cryptographic key compiled directly into the application code.
A hardcoded key is not a secret. It is identical across every installation running the same software version. There is no per-deployment key derivation, no HSM integration, no customer-configurable secret. The key ships with the binaries.
An attacker who already holds high privileges and has local access to the server can pull the encrypted credential objects from the CMS data store, then use the hardcoded key from any matching installation to decrypt them. The advisory rates this as high impact to both confidentiality and integrity. The attacker can read the stored authentication data and modify protected information.
Who is affected
Affected package: SAP BusinessObjects Business Intelligence Platform (Central Management Server), namespace SAP_SE.
What SAP BusinessObjects is: SAP's enterprise BI suite, used by approximately 40,000 organizations worldwide for reporting, dashboards, and analytics. The Central Management Server is the core administration component that manages user accounts, authentication tokens, and connection credentials to external data sources (databases, FTP servers, Active Directory, LDAP).
Impact scope: Every stored credential the CMS holds becomes recoverable. That includes database connection strings with embedded passwords, AD/LDAP bind credentials, FTP accounts, and third-party API keys configured for scheduled data refreshes. An organization running BusinessObjects for years may have hundreds of service-account credentials sitting in that store.
SAP has not published fixed version strings in the CVE data feed. Check SAP Note 3594149 on the SAP Support Portal for the specific patch level for your deployment.
Why it matters
Hardcoded cryptographic keys are defective by construction. The moment the key is extracted from one binary, it works against every installation of that version globally. There is no patching the key without rotating every credential encrypted under it, because the old ciphertext can be decrypted by anyone who still has the old binary.
The attack requires high privileges and local access, which limits the immediate threat surface. Combine those prerequisites with the reality of enterprise environments: service accounts accumulate, server access logs are rarely reviewed, and the credentials cached in BI platforms connect to production databases containing financial and customer data. A single compromised admin account on the BI server becomes a pipeline into the broader database estate.
This is not in CISA's Known Exploited Vulnerabilities catalog. No public exploit code has been published. The risk is structural rather than imminent, but the remediation effort is substantial because it requires a full credential rotation after patching.
What to do
- Apply SAP Note 3594149. Log in to the SAP Support Portal and pull the note for the specific patch applicable to your BusinessObjects version.
- Audit local access. Review who has high-privilege local accounts on your CMS servers. Restrict SSH/RDP access to a controlled jump-box workflow.
- Rotate every stored credential. After patching, re-enter all database connection passwords, AD bind credentials, FTP accounts, and API keys in the CMS. The old encrypted objects are now recoverable by anyone with the old binary.
- Check for prior exfiltration. If local access was shared broadly or logging is sparse, treat the credential store as compromised. Rotate downstream database and AD credentials independently of the BusinessObjects patch.
References
Continue reading
All posts
CVE-2026-72603: wg-easy WireGuard UI Lets Low-Privilege Users Execute Root Commands
wg-easy 15.3.0 has an OS command injection vulnerability in its client creation flow. Users with clients.create permission can inject WireGuard PostUp directives via newlines in the client name field, achieving root code execution.
CVE-2026-72533: Portainer CE Authentication Bypass Grants Root Access to Docker Hosts
Portainer CE through 2.44.0 has an authentication bypass in its Docker proxy endpoint. Low-privileged users can craft non-canonical URL paths to bypass authorization checks and gain root-level access to the Docker host.
CVE-2026-58231: Unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter
SAP Commerce Cloud Data Hub Adapter ships with a default authentication client. An unauthenticated attacker can submit crafted input to validation-lacking functions, achieving arbitrary code execution. No fix available yet.