CRITICALVulnerability
Global

April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More

·Source: The Hacker News (Blog)

Updated:

Executive Summary

A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April's Patch Tuesday releases. Topping the list is an SQL injection vulnerability impacting SAP Business Planning and Consolidation and SAP Business Warehouse (CVE-2026-27681, CVSS score: 9.9) that could result in the execution of arbitrary database

Analysis

A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April's Patch Tuesday releases. Topping the list is an SQL injection vulnerability impacting SAP Business Planning and Consolidation and SAP Business Warehouse (CVE-2026-27681, CVSS score: 9.9) that could result in the execution of arbitrary database

Indicators of Compromise (1)

CVE (1)
CVE-2026-27681
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News (Blog) on Apr 15, 2026.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-108109 — PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the c...

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

CVE-2026-108109
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-108107 — PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerabi...

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

CVE-2026-108107
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-108101 — HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulne...

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

CVE-2026-108101
NIST NVD