Log in Start free

Vulnerability · Published Mar 10, 2026 · Assigned by sap

CVE-2026-27686Missing Authorization check in SAP Business Warehouse (Service API)

Medium 5.9

In plain English

A medium-severity missing authorization in SAP Business Warehouse (Service API) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 83.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP Business Warehouse (Service API) DW4CORE 200300400PI_BASIS 2006_1_700701702730731

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

References