CVE-2026-27681
Received Received - Intake
SQL Injection in SAP BPC and BW Enables Data Compromise

Publication date: 2026-04-14

Last updated on: 2026-04-14

Assigner: SAP SE

Description
Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-14
Last Modified
2026-04-14
Generated
2026-06-16
AI Q&A
2026-04-14
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27681
EUVD
EUVD-2026-22154
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
sap business_planning_and_consolidation *
sap business_warehouse *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse.

An authenticated user can exploit this flaw to execute crafted SQL statements that allow them to read, modify, and delete database data.

This means the attacker can manipulate the database in unauthorized ways, potentially compromising the system.

Impact Analysis

The vulnerability has a high impact on the confidentiality, integrity, and availability of the affected system.

  • Confidentiality: Unauthorized reading of sensitive data.
  • Integrity: Unauthorized modification of database data.
  • Availability: Unauthorized deletion of data, potentially disrupting system operations.
Compliance Impact

The vulnerability allows an authenticated user to execute crafted SQL statements to read, modify, and delete database data, impacting the confidentiality, integrity, and availability of the system.

Such impacts on data security can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require strict protection of sensitive data and system integrity.

However, the provided information does not explicitly state the direct effects on compliance with these standards.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart