CVE-2026-24318

CVE-2026-24318 is an insecure session management vulnerability affecting SAP Business Objects Business Intelligence Platform. An unauthenticated attacker could obtain and reuse valid session tokens to gain unauthorized access to legitimate user sessions, potentially accessing or modifying sensitive information within the victim's authenticated context. The vulnerability impacts confidentiality and integrity but not system availability. The vulnerability has a CVSS score of 4.2 (Medium severity) and requires network access with high attack complexity and user interaction. The attack vector is network-based, making it remotely exploitable but dependent on specific conditions being met and user involvement for successful exploitation. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. With an EPSS score of 0.00037 and a FAUCET risk score of 29.0/100, the immediate threat level is low, though organizations should still prioritize patching as part of routine vulnerability management practices.