CVE-2026-27681

CRITICAL

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.

CVSS v3.1 Score

9.9
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 4/14/2026Modified: 4/17/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (2)

https://me.sap.com/notes/3719353https://url.sap/sapsecuritypatchday