SAP Note 3719353
SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse
CriticalCVSS 9.9SAP Business Planning and Consolidation and SAP Business Warehouse
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
- CVE(s)
- CVE-2026-27681
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products and versions
- Product SAP Business Planning and Consolidation and SAP Business Warehouse
Versions: HANABPC 810, BPC4HANA 300, SAP_BW 750, 752, 753, 754, 755, 756, 757, 758, 816
Appears in
Patch Days listing this note, newest first.
- April 2026CriticalCVSS 9.9