Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-27681

SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP Business Planning and Consolidation and SAP Business Warehouse

Default version status: unaffected

  • HANABPC 810affected
  • BPC4HANA 300affected
  • SAP_BW 750affected
  • 752affected
  • 753affected
  • 754affected
  • 755affected
  • 756affected
  • 757affected
  • 758affected
  • 816affected

References