by Kastro
Paper/Archive/CVE-2026-27681

CVE-2026-27681

SAP_SE SAP Business Planning and Consolidation and SAP Business Warehouse — SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
38
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 42.9.429 × 208.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.

Affected

ProductAffectedFixed inSource
SAP Business Planning and Consolidation and SAP Business WarehouseHANABPC 810–CNA
SAP Business Planning and Consolidation and SAP Business WarehouseBPC4HANA 300–CNA
SAP Business Planning and Consolidation and SAP Business WarehouseSAP_BW 750–CNA
SAP Business Planning and Consolidation and SAP Business Warehouse752–CNA
SAP Business Planning and Consolidation and SAP Business Warehouse753–CNA
SAP Business Planning and Consolidation and SAP Business Warehouse754–CNA
SAP Business Planning and Consolidation and SAP Business Warehouse755–CNA
SAP Business Planning and Consolidation and SAP Business Warehouse756–CNA
SAP Business Planning and Consolidation and SAP Business Warehouse757–CNA
SAP Business Planning and Consolidation and SAP Business Warehouse758–CNA
SAP Business Planning and Consolidation and SAP Business Warehouse816–CNA

Scores by source

sap (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3719353refurl.sap/sapsecuritypatchday