CVE-2026-27681

CVE Enrichment

CVSS: 9.9 CRITICAL
EPSS: 0.50%
EPSS Percentile: 43.07%
CISA KEV: Not listed

Description

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 14-Apr-2026 07:16
Last Modified: 27-Oct-2026 05:10
EPSS Date: 2026-11-05
CWE: CWE-89

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

SAP_SE · SAP Business Planning and Consolidation and SAP Business Warehouse Source: CNA · [email protected]
Default status: unaffected

HANABPC 810 — affected
BPC4HANA 300 — affected
SAP_BW 750 — affected
752 — affected
753 — affected
754 — affected
755 — affected
756 — affected
757 — affected
758 — affected
816 — affected

References

Last enrichment sync: 06-Nov-2026 05:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

vendors, led by an SQL injection in SAP Business Planning and Consolidation/SAP Business Warehouse (CVE-2026-27681, CVSS 9.9) that can execute arbitrary database commands. April Patch Tuesday Updates Address Critical Flaws Across Major Vendors
The most severe of the resolved flaws is CVE-2026-27681 (CVSS score of 9.9), a critical SQL injection bug in Business Planning and Consolidation and Business Warehouse that could lead to arbitrary code execution. SAP’s April 2026 Security Updates Fix Critical ABAP SQL Injection

CVE (10)

People (2)

Vendors (4)

Products (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.