VulnSocial

CVE-2026-66763Patch

LOWCVSS 7.9 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-08-11); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-11: 1Mentions · 2026-08-27: 1Patch / Workaround · 2026-08-11: 1Patch / Workaround · 2026-08-27: 1Technical Details · 2026-08-11: 1Technical Details · 2026-08-27: 108-1108-27
Signal classification1 categories
Patch
2100.0%
Referenced assets1 URL
Full discourse2 posts
  • HOL@HashgraphOnline
    Patch

    CVE-2026-66763: SAP BusinessObjects CMS encrypts stored credentials with a hardcoded cryptographic key baked into the source code. Same key ships with every installation. Anyone with local server access can decrypt every stored password. Fix: Apply SAP Note 3594149, then rotate every credential. https://hol.org/blog/cve-2026-66763-sap-businessobjects-cms-hardcoded-crypto-key

    Post summary

    A hardcoded key vulnerability in SAP BusinessObjects CMS is disclosed with an available patch (SAP Note 3594149); applying the note and rotating credentials mitigates the risk.

    01010651
    16.6K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-66763 (CVSS 7.9) SAP BusinessObjects BI Platform stores credentials with hard-coded crypto key. Attackers with high privs + local access can decrypt sensitive auth data. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/FKCLgcmLra

    Post summary

    The tweet highlights CVE-2026-66763’s credential‑exposure flaw in SAP BusinessObjects, urges immediate patching, and provides some technical details about the vulnerability.

    0000043
    115 followersView on X

Explore more

Back to dashboard