Vulnerability · Published Apr 14, 2026 · Assigned by sap
CVE-2026-27681SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse
Critical 9.9
In plain English
A critical-severity SQL injection in SAP Business Planning and Consolidation and SAP Business Warehouse from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.5%top 56.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Business Planning and Consolidation and SAP Business Warehouse | HANABPC 810BPC4HANA 300SAP_BW 750752753754755756 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H