PT-2026-32560 · Sap Se · Sap Business Planning/Consolidation/Sap Business Warehouse

Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-27681

NVD

CVSS v3.1

9.9

Critical

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-27681

Affected Products

Sap Business Planning/Consolidation/Sap Business Warehouse

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-27681 · Security Note
• https://twitter.com/TweetThreatNews/status/2044049305338532349 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://me.sap.com/notes/3719353 · Note
• https://twitter.com/0dayPublishing/status/2043844099350880543 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044026541147836840 · Twitter Post
• https://twitter.com/CVEnew/status/2043976161529647246 · Twitter Post
• https://twitter.com/CveFindCom/status/2043852462642041104 · Twitter Post
• https://twitter.com/OrizonCyber/status/2043879462471667844 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2044023123654131926 · Twitter Post
• https://twitter.com/CVEarity/status/2044056615176024290 · Twitter Post