CVE Intelligence
Analysis AI-assisted

CVE-2026-27681: SAP BPC and SAP BW SQL Injection via Authorization Flaw

SAP has published CVE-2026-27681, which affects SAP Business Planning and Consolidation and SAP Business Warehouse. Insufficient authorization checks allow an authenticated user to run crafted SQL statements that can read, modify, and delete database data. The record rates the issue critical with a CVSS v3.1 base score of 9.9 and maps it to CWE-89, but it lists no affected or fixed versions, so the SAP references should be consulted directly.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-27681 is described by SAP as a result of insufficient authorization checks in SAP Business Planning and Consolidation (BPC) and SAP Business Warehouse (BW). The record maps the weakness to CWE-89 (SQL Injection). The record was published on 2026-04-14 and its status in the consulted data is Awaiting Analysis.

Impact

The CNA description states a high impact on confidentiality, integrity, and availability. An authenticated user could, according to the description, read, modify, and delete database data.

  • Confidentiality: rated high in the CNA description.
  • Integrity: rated high in the CNA description.
  • Availability: rated high in the CNA description.
  • The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H is listed with a base score of 9.9. Under standard CVSS definitions this indicates a network-reachable issue requiring low privileges, no user interaction, and a scope change (inference from the vector).

Affected products and versions

The products named in the record are SAP Business Planning and Consolidation and SAP Business Warehouse. The consulted record contains no list of affected or fixed version strings, so the exact affected versions are unknown. Review SAP Note 3719353 and the SAP Security Patch Day page to determine applicability to your landscape.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the consulted data. No confirmed exploitation appears in the sources consulted. The EPSS record shows a probability of 0.00549 and a percentile of 0.44444, which are estimates and not evidence of exploitation.

Remediation and mitigation

  • Check SAP Note 3719353 and the SAP Security Patch Day page for the corrective measures and applicable component versions.
  • Prioritize patching of BPC and BW systems given the critical rating and the authenticated-user attack precondition.
  • Limit the number of accounts that hold access to BPC and BW to those with a clear business need.
  • Review authorization roles and restrict database-level privileges granted to application and service accounts.

Detection guidance

  • Review database and application audit logs for unusual query patterns or unexpected modification and deletion of data originating from BPC or BW.
  • Monitor authentication activity for accounts that show access patterns inconsistent with their assigned roles.
  • Correlate changes in critical planning or warehouse data with user activity to support investigation.

Limitations of the available information

  • The consulted record does not list affected or fixed versions, so applicability cannot be determined from this record alone.
  • No technical details beyond the CWE classification and CNA description are present in the record.
  • The EPSS date (2026-10-13) is later than the publication date (2026-04-14); treat this value with caution.
  • No ransomware-use or KEV data is available because the entry is not listed in KEV.
  • Exploit details are not provided here by design.

Frequently asked questions

What is CVE-2026-27681?

It is a SQL injection weakness (CWE-89) in SAP Business Planning and Consolidation and SAP Business Warehouse, caused by insufficient authorization checks that let an authenticated user run crafted SQL statements.

How severe is this issue?

The record lists a critical severity with a CVSS v3.1 base score of 9.9, provided by the CNA SAP.

Is this vulnerability known to be actively exploited?

It is not listed in the CISA KEV catalog in the consulted data, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The consulted record does not list affected or fixed versions. Check SAP Note 3719353 and the SAP Security Patch Day page for details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.