Introduction
An authenticated user with nothing more than low-level access to SAP Business Planning and Consolidation or SAP Business Warehouse can inject arbitrary SQL statements to read, modify, and delete database data. The vulnerability carries a CVSS score of 9.9. With 98 of the world's 100 largest companies among SAP's customers, the potential blast radius of unpatched BPC and BW deployments that handle financial planning and consolidation data is substantial.
Technical Information
The root cause of CVE-2026-27681 is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. SAP Business Planning and Consolidation and SAP Business Warehouse do not perform sufficient authorization checks on user-supplied input before including it in SQL queries. An authenticated attacker can therefore inject crafted SQL statements, which the database engine executes with the application's privileges.
The CVSS 3.1 vector string is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which breaks down as follows:
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over the network |
| Attack Complexity | Low | No specialized conditions required |
| Privileges Required | Low | Only low-level authenticated access needed |
| User Interaction | None | No action from another user required |
| Scope | Changed | Impact extends beyond the vulnerable component |
| Confidentiality | High | Full read access to database data |
| Integrity | High | Ability to modify database records |
| Availability | High | Ability to delete database data |
Attack Flow
Based on the available information, exploitation would proceed in these stages:
- An attacker authenticates to the affected SAP BPC or BW system with a valid but low-privilege account.
- The attacker finds an input field or API endpoint where user-supplied data is passed into a SQL query without proper sanitization or parameterization.
- The attacker crafts a malicious SQL payload that gets past the insufficient authorization checks.
- The injected SQL commands execute in the context of the database connection the application uses.
- The attacker can now extract sensitive financial planning data, modify consolidation records, or delete critical business warehouse content.
Scope Change and Cascading Impact
The scope is rated as changed (S:C). SAP BPC and BW are typically connected to backend databases (such as SAP HANA) that serve multiple applications, so successful exploitation could cascade beyond the BPC/BW application layer and compromise data belonging to other SAP modules or integrated systems that share the same database infrastructure.
Affected Systems and Versions
The affected products are:
- SAP Business Planning and Consolidation (BPC)
- SAP Business Warehouse (BW)
Specific affected version numbers are not available in public repositories. SAP has gated this information behind the SAP ONE Support launchpad, so security teams must log into the portal and open SAP Note 3719353 to see which versions apply to their environments.
Vendor Security History
CVE-2026-27681 is one of several SQL injection vulnerabilities found in SAP products in early 2026:
| CVE ID | Affected Component | Disclosure | Description |
|---|---|---|---|
| CVE-2026-0501 | SAP S/4HANA Private Cloud and On Premise | January 2026 | SQL Injection in Financials General Ledger |
| CVE-2026-27684 | SAP NetWeaver Feedback Notification | March 2026 | SQL Injection allowing authenticated attackers to inject code |
| CVE-2026-27681 | SAP BPC and BW | April 2026 | Insufficient authorization checks enabling database manipulation |
Repeated SQL injection findings in different SAP products within a single quarter suggest a systemic problem with input validation and authorization enforcement in the SAP codebase. Organizations running SAP landscapes should consider reviewing more than the specific components named in each advisory.
SAP SE reported total revenue of 36.8 billion Euros in 2025 and employs over 110,000 people. The company follows a monthly security patch cadence and releases corrections on the second Tuesday of each month. The April 2026 Security Patch Day fell on April 14 and coincided with the disclosure of this vulnerability.
