CVE-2026-24325 is a stored Cross-Site Scripting (XSS) vulnerability classified under CWE-79, found in SAP BusinessObjects Enterprise Central Management Console. The root cause is insufficient neutralization of user-supplied input during web page generation, which allows an authenticated administrator to inject malicious JavaScript code into the web interface. When other users access the compromised page, the injected script executes in their browsers, potentially leading to session hijacking, credential theft, or unauthorized actions within the application context. The vulnerability requires an attacker to have high privileges (admin user) and involves user interaction (visiting the compromised page). The CVSS v3.1 score is 4.8, reflecting medium severity, with low impact on confidentiality and integrity, and no impact on availability. Affected versions include ENTERPRISE 430, 2025, and 2027. No public exploits are known, but the vulnerability poses a risk in environments where multiple administrators or users access the Central Management Console. The vulnerability highlights the need for proper input encoding and sanitization in web applications, especially those managing critical business intelligence data.

For European organizations, this vulnerability could allow malicious administrators to execute arbitrary JavaScript in the context of the SAP BusinessObjects Enterprise Central Management Console. While the impact on confidentiality and integrity is low, attackers could potentially steal session tokens, manipulate user interface elements, or perform unauthorized actions on behalf of other users, undermining trust and operational security. The lack of availability impact reduces the risk of service disruption, but the exploitation could facilitate further attacks or data leakage. Organizations relying heavily on SAP BusinessObjects for business intelligence and reporting may face reputational damage and compliance risks if sensitive data is exposed or manipulated. The requirement for admin privileges and user interaction limits the attack surface but does not eliminate the risk in environments with multiple privileged users or insufficient internal controls.

1. Apply official patches or updates from SAP as soon as they become available for the affected versions (ENTERPRISE 430, 2025, 2027). 2. Implement strict input validation and output encoding on all user inputs in the Central Management Console to prevent injection of malicious scripts. 3. Limit the number of users with administrative privileges and enforce the principle of least privilege to reduce the risk of insider threats. 4. Conduct regular security training for administrators to recognize and avoid introducing malicious content. 5. Monitor logs and user activities within the Central Management Console for unusual behavior indicative of exploitation attempts. 6. Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in the web interface. 7. Use multi-factor authentication (MFA) for admin accounts to reduce the risk of credential compromise. 8. Regularly review and audit configurations and customizations in SAP BusinessObjects to detect potential injection points.