CVE-2026-27681

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27681", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-02-23T17:50:17.027Z", "datePublished": "2026-04-14T00:08:05.791Z", "dateUpdated": "2026-04-14T13:14:18.028Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-04-14T00:08:05.791Z"}, "title": "SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Business Planning and Consolidation and SAP Business Warehouse", "versions": [{"status": "affected", "version": "HANABPC 810"}, {"status": "affected", "version": "BPC4HANA 300"}, {"status": "affected", "version": "SAP_BW 750"}, {"status": "affected", "version": "752"}, {"status": "affected", "version": "753"}, {"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}, {"status": "affected", "version": "758"}, {"status": "affected", "version": "816"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3719353"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27681", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-14T12:54:23.920893Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:14:18.028Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27681", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-14T12:54:23.920893Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:09:08.544Z"}}], "cna": {"title": "SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Business Planning and Consolidation and SAP Business Warehouse", "versions": [{"status": "affected", "version": "HANABPC 810"}, {"status": "affected", "version": "BPC4HANA 300"}, {"status": "affected", "version": "SAP_BW 750"}, {"status": "affected", "version": "752"}, {"status": "affected", "version": "753"}, {"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}, {"status": "affected", "version": "758"}, {"status": "affected", "version": "816"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3719353"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-04-14T00:08:05.791Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27681", "state": "PUBLISHED", "dateUpdated": "2026-04-14T13:14:18.028Z", "dateReserved": "2026-02-23T17:50:17.027Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-04-14T00:08:05.791Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Business Planning and Consolidation and SAP Business Warehouse", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "HANABPC 810"}, {"status": "affected", "version": "BPC4HANA 300"}, {"status": "affected", "version": "SAP_BW 750"}, {"status": "affected", "version": "752"}, {"status": "affected", "version": "753"}, {"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}, {"status": "affected", "version": "758"}, {"status": "affected", "version": "816"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system."}, {"lang": "es", "value": "Debido a controles de autorizaci\u00f3n insuficientes en SAP Business Planning and Consolidation y SAP Business Warehouse, un usuario autenticado puede ejecutar sentencias SQL manipuladas para leer, modificar y eliminar datos de la base de datos. Esto conlleva a un alto impacto en la confidencialidad, integridad y disponibilidad del sistema."}], "id": "CVE-2026-27681", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27681", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T12:54:23.920893Z", "version": "2.0.3"}}]}, "published": "2026-04-14T00:16:06.560", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3719353"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "HANABPC 810"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "BPC4HANA 300"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BW 750"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "752"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "753"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "754"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "755"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "756"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "757"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "758"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "816"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "SAP Business Planning and Consolidation and SAP Business Warehouse", "source": "cna", "vendor": "SAP_SE"}, "product": "business_planning_and_consolidation", "vendor": "sap"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "HANABPC 810"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "BPC4HANA 300"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BW 750"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "752"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "753"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "754"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "755"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "756"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "757"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "758"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "816"}}], "original": {"product": "SAP Business Planning and Consolidation and SAP Business Warehouse", "source": "cna", "vendor": "SAP_SE"}, "product": "business_warehouse", "vendor": "sap"}], "analysis": {"en": {"generated_at": "2026-04-14T01:50:27.861790+00:00", "value": {"mitigation_remediation": ["Apply the patch documented in SAP Note 3719353.", "Download and install the latest security patches from the SAP Security Patch Day website.", "If a patch is delayed, restrict privileged user accounts and audit query logs for suspicious activity."], "summary": {"action": "Immediate Patch", "impact": "SQL injection enabling data compromise and integrity loss"}, "threat_synthesis": {"affected_systems": "SAP Business Planning and Consolidation and SAP Business Warehouse from SAP SE are the affected products. Version information is not disclosed, so the vulnerability could affect multiple releases. Any user with valid credentials who can execute business planning queries is at risk.", "description_and_impact": "An authenticated user can employ crafted SQL statements within SAP Business Planning and Consolidation and SAP Business Warehouse because of insufficient authorization checks. This susceptibility allows the attacker to read, modify or delete database records, severely compromising confidentiality, integrity, and availability. The related weakness is CWE\u201189, a classic SQL injection flaw.", "risk_and_exploitability": "The CVSS score of 9.9 classifies this vulnerability as critical. EPSS data is unavailable, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires authentication but otherwise imposes no further constraints; a legitimate user with compromised credentials could abuse the flaw. No publicly available exploits are reported, yet the high severity warrants immediate attention."}}}}, "created": "2026-04-14T16:16:25.673148+00:00", "updated": "2026-04-14T16:31:22.202847+00:00", "vendors": ["sap", "sap$PRODUCT$business_planning_and_consolidation", "sap$PRODUCT$business_warehouse"]}