CVE-2026-27681

CRITICAL

SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse

Title source: cna

Description

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.

References (2)

https://me.sap.com/notes/3719353

https://url.sap/sapsecuritypatchday

Scores

CVSS v3 9.9

EPSS 0.0005

EPSS Percentile 16.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-89

Status published

Products (11)

SAP_SE/SAP Business Planning and Consolidation and SAP Business Warehouse 752

SAP_SE/SAP Business Planning and Consolidation and SAP Business Warehouse 753

SAP_SE/SAP Business Planning and Consolidation and SAP Business Warehouse 754

SAP_SE/SAP Business Planning and Consolidation and SAP Business Warehouse 755

SAP_SE/SAP Business Planning and Consolidation and SAP Business Warehouse 756

SAP_SE/SAP Business Planning and Consolidation and SAP Business Warehouse 757

SAP_SE/SAP Business Planning and Consolidation and SAP Business Warehouse 758

SAP_SE/SAP Business Planning and Consolidation and SAP Business Warehouse 816

SAP_SE/SAP Business Planning and Consolidation and SAP Business Warehouse BPC4HANA 300

SAP_SE/SAP Business Planning and Consolidation and SAP Business Warehouse HANABPC 810

... and 1 more

Published Apr 14, 2026

Tracked Since Apr 14, 2026