PT-2026-32560 · Sap · Sap Business Planning/Consolidation+1

Published 2026-04-14 · Updated 2026-05-12 · CVE-2026-27681

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business Planning and Consolidation (affected versions not specified) SAP Business Warehouse (affected versions not specified)

Description Insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse allow an authenticated user with low privileges to execute crafted SQL statements over the network. This issue occurs because a vulnerable ABAP program allows the upload of files containing arbitrary SQL statements, which are then executed. This can lead to arbitrary database command execution, enabling attackers to read, modify, and delete database data, as well as escalate privileges and move laterally across networks via database compromise. This significantly impacts the confidentiality, integrity, and availability of the system.

Recommendations Apply the updates provided in the April Patch Tuesday release for SAP Business Planning and Consolidation. Apply the updates provided in the April Patch Tuesday release for SAP Business Warehouse.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-05447

CVE-2026-27681

Affected Products

Sap Business Planning/Consolidation

Sap Business Warehouse

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2026-27681 · Security Note
• https://bdu.fstec.ru/vul/2026-05447 · Security Note
• https://twitter.com/0dayPublishing/status/2043844099350880543 · Twitter Post
• https://twitter.com/CCBalert/status/2044119106538910121 · Twitter Post
• https://thehackernews.com/2026/04/april-patch-tuesday-fixes-critical.html · Reddit Post
• https://twitter.com/VulmonFeeds/status/2044026541147836840 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/TweetThreatNews/status/2044626864203821454 · Twitter Post
• https://twitter.com/OrizonCyber/status/2043879462471667844 · Twitter Post
• https://twitter.com/CveFindCom/status/2043852462642041104 · Twitter Post
• https://me.sap.com/notes/3719353 · Note
• https://twitter.com/CVEnew/status/2043976161529647246 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2044023123654131926 · Twitter Post
• https://twitter.com/CVEarity/status/2044056615176024290 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2044049305338532349 · Twitter Post