← Back to browse · API

CVE-2026-27681

Severity
CRITICAL
CVSS
9.9
EPSS
0.00501
Risk score
39.78
CISA KEV
No
PoC
No
Published
2026-04-14
Modified
2026-04-14
First seen
2026-08-07
Aliases
EUVD-2026-22154, GHSA-QV8Q-6Q9M-8CH9
Products
SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse 752, SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse 753, SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse 754, SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse 755, SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse 756, SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse 757, SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse 758, SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse 816, SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse BPC4HANA 300, SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse HANABPC 810, SAP_SE:SAP Business Planning and Consolidation and SAP Business Warehouse SAP_BW 750
Sources
euvd EUVD-2026-22154

Description

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.

References