CVE-2026-27686

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27686", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-02-23T17:50:17.028Z", "datePublished": "2026-03-10T00:18:33.189Z", "dateUpdated": "2026-03-10T16:52:48.429Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-03-10T00:18:33.189Z"}, "title": "Missing Authorization check in SAP Business Warehouse (Service API)", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Business Warehouse (Service API)", "versions": [{"status": "affected", "version": "DW4CORE 200"}, {"status": "affected", "version": "300"}, {"status": "affected", "version": "400"}, {"status": "affected", "version": "PI_BASIS 2006_1_700"}, {"status": "affected", "version": "701"}, {"status": "affected", "version": "702"}, {"status": "affected", "version": "730"}, {"status": "affected", "version": "731"}, {"status": "affected", "version": "740"}, {"status": "affected", "version": "SAP_BW 750"}, {"status": "affected", "version": "751"}, {"status": "affected", "version": "752"}, {"status": "affected", "version": "753"}, {"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}, {"status": "affected", "version": "758"}, {"status": "affected", "version": "816"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3703385"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T15:35:59.612402Z", "id": "CVE-2026-27686", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T16:52:48.429Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27686", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T15:35:59.612402Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T15:36:00.769Z"}}], "cna": {"title": "Missing Authorization check in SAP Business Warehouse (Service API)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Business Warehouse (Service API)", "versions": [{"status": "affected", "version": "DW4CORE 200"}, {"status": "affected", "version": "300"}, {"status": "affected", "version": "400"}, {"status": "affected", "version": "PI_BASIS 2006_1_700"}, {"status": "affected", "version": "701"}, {"status": "affected", "version": "702"}, {"status": "affected", "version": "730"}, {"status": "affected", "version": "731"}, {"status": "affected", "version": "740"}, {"status": "affected", "version": "SAP_BW 750"}, {"status": "affected", "version": "751"}, {"status": "affected", "version": "752"}, {"status": "affected", "version": "753"}, {"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}, {"status": "affected", "version": "758"}, {"status": "affected", "version": "816"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3703385"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-03-10T00:18:33.189Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27686", "state": "PUBLISHED", "dateUpdated": "2026-03-10T16:52:48.429Z", "dateReserved": "2026-02-23T17:50:17.028Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-03-10T00:18:33.189Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Business Warehouse (Service API)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "DW4CORE 200"}, {"status": "affected", "version": "300"}, {"status": "affected", "version": "400"}, {"status": "affected", "version": "PI_BASIS 2006_1_700"}, {"status": "affected", "version": "701"}, {"status": "affected", "version": "702"}, {"status": "affected", "version": "730"}, {"status": "affected", "version": "731"}, {"status": "affected", "version": "740"}, {"status": "affected", "version": "SAP_BW 750"}, {"status": "affected", "version": "751"}, {"status": "affected", "version": "752"}, {"status": "affected", "version": "753"}, {"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}, {"status": "affected", "version": "758"}, {"status": "affected", "version": "816"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected."}, {"lang": "es", "value": "Debido a una falta de comprobaci\u00f3n de autorizaci\u00f3n en SAP Business Warehouse (API de servicio), un atacante autenticado podr\u00eda realizar acciones no autorizadas a trav\u00e9s de un m\u00f3dulo de funci\u00f3n RFC afectado. La explotaci\u00f3n exitosa podr\u00eda permitir cambios no autorizados en la configuraci\u00f3n y el control, interrumpiendo potencialmente el procesamiento de solicitudes y causando denegaci\u00f3n de servicio. Esto resulta en un bajo impacto en la integridad y un alto impacto en la disponibilidad, mientras que la confidencialidad no se ve afectada."}], "id": "CVE-2026-27686", "lastModified": "2026-06-17T10:27:31.087", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27686", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T15:35:59.612402Z", "version": "2.0.3"}}]}, "published": "2026-03-10T17:38:11.147", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3703385"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "DW4CORE 200"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "300"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "400"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "PI_BASIS 2006_1_700"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "701"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "702"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "730"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "731"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "740"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BW 750"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "751"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "752"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "753"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "754"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "755"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "756"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "757"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "758"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "816"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SAP Business Warehouse (Service API)", "source": "cna", "vendor": "SAP_SE"}, "product": "sap_business_warehouse_(service_api)", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-16T09:55:34.545551+00:00", "value": {"mitigation_remediation": ["Review and apply the security patch detailed in SAP Note 3703385 to correct the missing authorization check.", "If an immediate patch is not possible, enforce stricter authorization controls on the affected RFC function module, ensuring only privileged accounts can invoke it.", "Configure monitoring and alerting on SAP logs for anomalous RFC calls or configuration changes to detect potential unauthorized activity."], "summary": {"action": "Patch", "impact": "Unauthorized configuration and control changes leading to potential denial of service"}, "threat_synthesis": {"affected_systems": "The vulnerability targets SAP Business Warehouse (Service API) from SAP SE. No specific version information is disclosed, so all installations of the Service API that may use the exposed RFC function module should be considered potentially affected until further vendor guidance is received.", "description_and_impact": "A missing authorization check in the SAP Business Warehouse (Service API) allows an authenticated attacker to invoke an affected RFC function module and execute unauthorized actions. This flaw can be used to alter configuration settings, disrupt request processing, and ultimately cause a denial of service, impacting service availability while leaving integrity low and confidentiality unchanged. The weakness corresponds to CWE\u2011862, an improper authorization bypass.", "risk_and_exploitability": "The CVSS score is 5.9, indicating moderate severity. EPSS shows a probability of exploitation of less than 1%, suggesting a very low likelihood of attack, and the flaw is not listed in the CISA KEV catalog. The attack vector is authenticated, meaning the attacker must already have valid credentials to access the system. Successful exploitation would result in denial of service through erroneous configuration changes."}}}}, "created": "2026-03-10T14:06:11.858689+00:00", "updated": "2026-04-16T10:00:14.089798+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_business_warehouse_(service_api)"]}