CVE-2026-58248

Executive Summary

CVE-2026-58248 is an unpatched XML External Entity (XXE) vulnerability affecting the SAP BusinessObjects Business Intelligence Platform, specifically the Web Intelligence component. A low-privileged, remote attacker can upload a specially crafted spreadsheet file containing malicious external references; when processed as a data source, the component resolves these references and discloses sensitive server-side file contents into a report. The vulnerability has a CVSS score of 6.5 (High) with high confidentiality impact, no integrity impact, and no availability impact. As of the time of writing, no patch, workaround, or public exploit code has been identified, and the CVE is not on the CISA Known Exploited Vulnerabilities (KEV) list.

Technical Analysis

The vulnerability class is CWE-611 — Improper Restriction of XML External Entity Reference (XXE). The attack surface resides in the Web Intelligence component of the SAP BusinessObjects Business Intelligence Platform, a widely deployed enterprise reporting and analytics solution.

Vulnerability Mechanism:

The NVD description indicates that the affected component processes spreadsheet files (e.g., XLSX/XLSM formats, which are ZIP-based XML containers) as data sources. The core issue is that when the platform parses these files, it resolves external entity references contained within the XML content. A malicious actor can craft a spreadsheet that includes an external entity pointing to a local file path on the server (e.g., using a URI such as file:///etc/passwd on Unix or file:///C:/Windows/... on Windows). Because the XML parser does not disable external entity resolution or restrict file access, the parser reads that file and places its contents into the resulting report output that the attacker views.

This is a classic XXE attack vector that has been observed in multiple enterprise BI platforms. The specific file format — spreadsheet — is an XML-based container, making it a suitable carrier for XML payloads.

Attack Surface:

• Authentication: Required — attacker needs low-privileged access to the Web Intelligence component.
• Network: Remote — the attack is conducted over the network.
• User Interaction: None — no user interaction required.
• Privilege Boundary: Low to High — the information disclosed is limited to files that the server-side service account can read (which for a database/BI platform is often systemic, escalating the practical impact).

Code-Level Details:

No specific code paths, function names, or parser configuration details are disclosed in the NVD description. The vulnerability mechanism is described at a high level only. It is reasonable to infer that the affected parser is embedded within the Web Intelligence data-import functionality, which handles spreadsheet ingestion. Insufficient technical detail is available to identify the exact library or routine; this report describes the vulnerability at the class level per accuracy rules.

Known Limitations:

• No affected version range is disclosed.
• No vendor security note or patch is available.
• No public exploit exists; analysis is inferred from vulnerability class and NVD description only.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (XXE) and the NVD description. Specific filenames, URIs, and endpoints are not disclosed and therefore are not fabricated.

Step 1 — Reconnaissance / Target Identification:

An attacker with low-privileged credentials must first authenticate to the SAP BusinessObjects BI Platform. Common initial access vectors include:

• Stolen or weak credentials (the platform is often exposed to corporate intranets or via SSO).
• Default accounts in misconfigured enterprise deployments.
• The Web Intelligence component URL is typically known (e.g., via the BI Launch Pad or OpenDocument endpoints), and it is reachable over the corporate network or via a VPN.

Step 2 — Triggering the Flaw:

The attacker uploads a crafted spreadsheet file (e.g., an .XLSX with modified XML internals) as a data source in the Web Intelligence document creation workflow. The file contains a document type definition (DTD) or inline DOCTYPE declaration with an external entity, e.g.:

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>

The entity reference is placed within a cell value or metadata field so that it will be parsed when the file is loaded. The attacker then creates a report that queries/ingests this file as a data source.

Step 3 — Payload / Execution:

When the Web Intelligence server processes the file, it performs the data-source import. The server's XML parser resolves the external entity, reads the referenced file, and the file content is embedded into the dataset the attacker defines. The attacker then runs or refreshes the report to view its output, which includes the server file contents.

Step 4 — Post-Exploitation Impact:

The attacker reads the contents of sensitive files readable by the BI service account. Realistic targets include:

• /etc/passwd (Unix user enumeration)
• Application configuration files (e.g., database connection strings with credentials)
• Encryption keys and keystore files
• Internal application source or data files
• Files from other services on the host

Because the BI platform often runs with a service account privileged to access database credentials and internal configuration, this "low-privileged" access (the attacker only needs platform access) can lead to full lateral movement into the data tier.

Impact Assessment

Confidentiality: High (per CVSS vector). The vulnerability is a pure information-disclosure flaw. The attacker can read arbitrary server-side files subject to filesystem permissions of the service account running the BI platform.

Integrity: None — the attacker cannot modify data or files.

Availability: None — the attack does not cause denial of service or resource exhaustion (although a large file read could theoretically cause a memory spike, this is not described in the NVD data).

Business Impact:

• Data Breach: Exposure of internal configuration files, potentially including database credentials used by the BI platform, which are often stored in platform configuration (e.g., connection strings to SAP HANA, SQL Server, or Oracle data sources).
• Lateral Movement: Stolen credentials may allow direct access to underlying data warehouses and source systems.
• Compliance Violations: For enterprise BI platforms handling regulated data (PCI-DSS, HIPAA, GDPR), a disclosure of internal credentials could trigger mandatory breach notification.
• Reputational Damage: Public disclosure of an unpatched file-read flaw in a major BI product undermines customer trust.

Blast Radius:

• The affected server(s) hosting the Web Intelligence component.
• The data sources to which the BI server has active connections (potentially including production databases).
• Any system accessible from the BI server via file shares or mounted volumes.

Attack Complexity and Preconditions: Low complexity (AC:L), the attachment/upload requires no special format beyond a well-formed spreadsheet; only low-privileged authentication is a barrier (PR:L). The score reflects that the impact is limited to file disclosure but is high (C:H).

Detection Guidance

Sigma Rule

title: SAP BusinessObjects Web Intelligence Spreadsheet XXE File Read
id: 9a2f81c4-6b3e-4a8d-a5c1-8e2f0b9f3a41
status: experimental
description: Detects upload of spreadsheets containing XML external entity declarations that attempt to read local server files, targeting SAP BusinessObjects Web Intelligence data source imports.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58248
tags:
    - attack.t1190
    - cve.2026-58248
    - cwe.611
author: Valtersit SOC
date: 2026/01/01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        # The file is written to the Web Intelligence temp/upload directory
        EventID: 11  # File creation
        TargetFilename|contains: '\BusinessObjects\'
        TargetFilename|endswith: '.xlsx'
    filter_known:
        TargetFilename|endswith: '_known_good.xlsx'
    condition: selection and not filter_known
level: high
falsepositives:
    - Legitimate spreadsheets uploaded by analysts via the BI Launch Pad
    - Authorized data-source refresh operations

YARA Rule

rule CVE_2026_58248_SAP_BO_Spreadsheet_XXE
{
    meta:
        author = "Valtersit SOC"
        description = "Detects spreadsheet files containing XML external entity declarations targeting local file paths, indicative of CVE-2026-58248 exploitation"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-58248"
        cve_id = "CVE-2026-58248"
        severity = "high"
    strings:
        // DOCTYPE declaration with entity pointing to local files
        $xxe_doctype = /<!DOCTYPE[^>]{0,2048}(SYSTEM|PUBLIC)[^>]{0,2048}(file:\/\/\/|\/etc\/|\/var\/|C:\\)/ ascii nocase
        // Entity reference patterns inside cell data
        $xxe_entity_1 = /&[A-Za-z_0-9]+;/ ascii
        // XLSX container magic bytes (ZIP with xl/ prefix)
        $xlsx_zip = "xl/"
        // Potential DTD in sheet XML (namespace markers)
        $sheet_ns = "http://schemas.openxmlformats.org/spreadsheetml"
    condition:
        uint16(0) == 0x4B50 and // PK ZIP header
        $xlsx_zip and $sheet_ns and $xxe_doctype and $xxe_entity_1
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-58248 SAP BusinessObjects Web Intelligence Spreadsheet XXE File Read Attempt"; flow:established,to_server; content:"multipart/form-data"; nocase; http.client_body; pcre:"/<!DOCTYPE[^>]{0,512}(SYSTEM|PUBLIC)[^>]{0,512}(file:\\/\\/\\/|\\/etc\\/|\\/var\\/|C:\\\\)/imsi"; metadata:attack_target SAP_BusinessObjects, cve CVE-2026-58248, cwe 611; classtype:attempted-user; sid:10058248; rev:1;)

Elastic Detection

// Detect file creation in the SAP BusinessObjects upload/temp directories
// that contain XXE-indicative content (best-effort on file signature)
any where
  // File creation events
  event.action == "creation" and
  // Target directory contains BusinessObjects path markers
  file.path contains "BusinessObjects" and
  // AND the file is a spreadsheet
  (file.extension == "xlsx" or file.extension == "xlsm" or
   file.name like "*spreadsheet*") and
  // AND the file content signature indicates XXE (via FEATURE flag)
  file.size > 1000 and
  // Look for the presence of XXE in a separate file-content index
  // if eql-on-content is available (e.g., via filebeat, with a content hash)
  file.hash.sha256 != ""

// Alternate rule: Network-level detection of the HTTP response
// where a server response contains paths like /etc/ inside a report output
network where
  event.action == "connection" and
  destination.port == 443 and
  source.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") and
  // Response contains file path markers that indicate the XXE data is in the report
  network.protocol == "http" and
  http.response.body contains "root:" and
  process.name == "tomcat*"

Splunk SPL Query

index=web sourcetype="access_combined" 
| where like(uri_path, "%OpenDocument%") OR like(uri_path, "%Webi%") 
| where like(form_data, "%multipart/form-data%") 
| rex field=form_data "(?i)<!DOCTYPE[^>]{0,2048}(file\\:///|/etc/|/var/|C:\\\\)" 
| rex field=response "(?i)/etc/passwd|root:|daemon:|bin:|sys:" 
| table _time, src_ip, user, uri_path, status, form_data, response
| sort - _time

# File-based detection (Windows Sysmon / Endpoint)
index=windows EventCode=11 
| where TargetFilename LIKE "%BusinessObjects%"
| where TargetFilename LIKE "%.xlsx" OR TargetFilename LIKE "%.xlsm"
| eval suspicious = if(match(TargetFilename, ".*temp.*|.*upload.*"), "suspicious", "check")
| where suspicious == "suspicious" 
| stats count by Host, User, TargetFilename

Wazuh OSSEC Rule

<group name="SAP_BusinessObjects_CVE_2026_58248,">
  <!-- Detect file creation in SAP BO directories with spreadsheet extension -->
  <rule id="582480" level="10" frequency="3" timeframe="120">
    <if_sid>550</if_sid> <!-- syscheck new_file as base -->
    <field name="file" type="pcre2">(?i)BusinessObjects.*\.(xlsx|xlsm)$</field>
    <description>Potential CVE-2026-58248 exploit attempt: malicious spreadsheet uploaded to SAP BusinessObjects.</description>
    <group>cve-2026-58248,cwe-611,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <!-- Detect the presence of a DOCTYPE/external entity inside files in BO dirs -->
  <rule id="582481" level="12">
    <if_sid>550</if_sid>
    <field name="file" type="pcre2">(?i)BusinessObjects</field>
    <file_diff>yes</file_diff>
    <description>CVE-2026-58248 indicator: external entity (DOCTYPE or SYSTEM) found in file content within SAP BO path.</description>
    <group>cve-2026-58248,cwe-611,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED.

As of this writing, no vendor patch, security note, hotfix, or updated version has been published by SAP for CVE-2026-58248. No workarounds have been provided by the vendor. The following actions should be taken immediately:

1) Immediate Mitigations (Compensating Controls):

• Restrict the Web Intelligence data-source upload feature: Disable spreadsheet upload functionality for non-admin users via platform role configuration. At minimum, remove the "Create Data Source from File" capability from low-privileged roles.
• Network Segmentation: Place the BusinessObjects BI server behind a firewall that restricts access to only authenticated, authorized user networks via VPN or zero-trust network access (ZTNA).
• File Upload Scanning: Deploy a content-inspection gateway (e.g., a web application firewall with XML/WAF rules, or an email/upload sandbox) in front of the upload endpoint that blocks any file containing <!DOCTYPE, SYSTEM, or file:/// patterns in the uploaded body.
• Run the service account with least-privilege filesystem access: Ensure the Windows service account running the BI platform has read access ONLY to directories required for operation — not system-wide read access.
• Credential Rotation: Rotate all credentials stored within the BusinessObjects configuration, as an attacker could exfiltrate connection strings through this flaw pre-patch.

2) Patch/Upgrade Steps:

• Continuously monitor: Subscribe to SAP Security Patch Day (every second Tuesday of the month) emails at https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html.
• Track the official SAP Security Note: When published, it will identify affected version ranges and provide the hotfix or upgrade path. At the time of writing, no note number is available.
• Plan the upgrade: Prepare for an eventual upgrade of BusinessObjects BI Platform to a fixed release. Test in a QA environment that mirrors production data-source connectors.

3) Long-Term Hardening:

• Disable external entity resolution globally in the BI platform's XML parser configuration, if platform documentation allows for it.
• Implement a periodic review of BI account roles to ensure no over-provisioned low-privilege users exist.
• Enable egress filtering on the BI server so that even if XXE attempts to read network resources (SSRF), outbound connections to internal hosts are restricted.
• Deploy a SIEM solution with the detection content above to identify attempted or successful exploitation.
• Apply the principle of "defense in depth" — the BI server service account should be a managed service account (gMSA) with restricted logon and storage permissions.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-58248 (NVD description, CVSS vector, CWE mapping)
2. SAP Security News & Notes — https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html (monitor for upcoming patch)
3. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-58248 is NOT listed as of the report date)
4. EPSS (Exploit Prediction Scoring System) — https://www.first.org/epss/ (EPSS score 0.00281, 20.4th percentile — low immediate exploit likelihood)
5. MITRE ATT&CK — https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application)

Known Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None identified as of the publication date. The CVE is not in the CISA KEV list, and no public PoC or exploit code has been discovered. The EPSS score (0.00281) indicates a low probability of active exploitation in the immediate future, but this is likely to trend upward if a patch and PoC are published.

Vendor Communication: No vendor advisory or security note has been located. The patch confidence of 0/4 indicates that no patch evidence from any tracked source exists at this time.