CVE-2026-44755

MediumCVSS 4.3

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters from authenticated users, resulting in an email spoofing vulnerability. This has low impact on integrity and does not affect confidentiality or availability.

Risk Assessment

The risk is the ability to send spoofed emails on behalf of the organization, which could enable social engineering attacks on recipients.

Recommendation

Apply patches provided by SAP and restrict user permissions for sending emails.

Other vulnerabilities in SAP Business Objects Business Intelligence Platform

CVE-2026-24318Medium
An insecure session management vulnerability in SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to obtain valid session tokens and reuse them to gain unauthorized access to a victim's session. If the application keeps accepting previously issued tokens after authentication, the attacker can assume the victim's authenticated context.

Original NVD description (English source)

SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by authenticated users, resulting in an email spoofing vulnerability.This vulnerability has a low impact on integrity and does not affect the confidentiality and availability of the application.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS