This vulnerability exists in the AdminTools component of SAP BusinessObjects Business Intelligence Platform. An authenticated user with standard privileges can submit a specially crafted query that causes the Content Management Server to crash, making the CMS unavailable. The flaw is identified as CWE‑405, reflecting improper handling of input that can trigger an application crash.

SAP SE’s SAP BusinessObjects Business Intelligence Platform (AdminTools) for the 2025, 2027, and 430 enterprise releases are affected. These versions run on the enterprise edition and the problem is present across all supported operating environments for those releases.

The CVSS base score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, although the vulnerability is not listed in the CISA KEV catalog. An attacker must first be authenticated with normal user rights to execute the vulnerable query, so the attack vector is local or internal. Successful exploitation would result in a denial of service to the Content Management Server, affecting availability while leaving confidentiality and integrity unchanged.