PT-2026-32557 · Sap · Sap S/4Hana

Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-27677

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions SAP S/4HANA (affected versions not specified)

Description Missing authorization checks in the SAP S/4HANA OData Service (Manage Reference Equipment) allow an attacker to update and delete child entities via OData services without proper authorization. This issue primarily impacts system integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-05448

CVE-2026-27677

Affected Products

Sap S/4Hana

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-27677 · Security Note
• https://bdu.fstec.ru/vul/2026-05448 · Security Note
• https://twitter.com/CVEarity/status/2044048275666584019 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2026.html · Note
• https://twitter.com/CVEnew/status/2043976164415291797 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://me.sap.com/notes/3715097 · Note