Medium severity · published Feb 10, 2026
CVE-2026-24324
Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools)
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable and resulting in the denial of service of the Content Management Server (CMS). Successful exploitation impacts system availability, while confidentiality and integrity remain unaffected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP BusinessObjects Business Intelligence Platform (AdminTools) · SAP_SE
ENTERPRISE 430; 2025; 2027 · source: vendor
BB
Businessobjects Business Intelligence Platform · Sap
430; 2025; 2027 · source: NVD
Affected product
SB
SAP BusinessObjects Business Intelligence Platform (AdminTools)
SAP_SE