SAP’s April 2026 Security Updates Fix Critical ABAP SQL Injection

Summary

SAP released 20 new and updated security notes for April 2026. The most severe fixes a critical SQL injection flaw in Business Planning and Consolidation and Business Warehouse; SAP reported no known in-the-wild exploitation.

Key points

CVE-2026-27681 is a critical SQL injection vulnerability in Business Planning and Consolidation and Business Warehouse, rated CVSS 9.9.
A low-privileged user could upload a file containing SQL statements; cited experts say exploitation could enable database access and alteration.
Onapsis says SAP addressed CVE-2026-27681 by deactivating the executable code.
CVE-2026-34256 is a high-severity missing authorization check in ERP and S/4HANA that could allow execution of an ABAP program and rewriting of existing eight-character executable programs.
The other notes address medium- and low-severity vulnerabilities across SAP products, including issues that could cause information disclosure, denial of service, code injection, or code execution in a browser.
SAP did not report that any of the vulnerabilities were being exploited in the wild and advised users to apply the security notes promptly.

Article Details

Event Type: SAP released 20 new and updated security notes as part of its April 2026 security patch day.
Impact: The critical CVE-2026-27681 SQL injection vulnerability in Business Planning and Consolidation and Business Warehouse could enable arbitrary code execution and database abuse, including access to or corruption of sensitive data. CVE-2026-34256 affects ERP and S/4 HANA and could allow execution of an ABAP program and rewriting of existing executable programs. Other patched flaws could cause information disclosure, denial of service, cross-site scripting, code injection, malicious-content redirection, or browser code execution. SAP did not mention exploitation in the wild.