Critical SQL Injection Vulnerability in SAP Products (CVE-2026-27681). Patch Immediately!

As part of its monthly Security Patch Day, SAP released 19 new security notes and one update addressing multiple vulnerabilities, including critical issues such as SQL injection, denial of service (DoS), and code injection.

Among them, CVE-2026-27681 is a critical SQL injection vulnerability affecting SAP Business Planning and Consolidation (BPC) and SAP Business Warehouse (BW). Successful exploitation could allow attackers to execute arbitrary SQL commands and fully compromise affected systems.

CVE-2026-27681 (CVSS 9.9) is caused by insufficient authorization checks , allowing an authenticated user with low privileges to execute arbitrary SQL commands, potentially leading to unauthorised access and data manipulation.

This could result in unauthorized access to sensitive database information, modification of critical business data, and potential denial of service through data deletion or manipulation, highly impacting the confidentiality, integrity, and availability of the system.

In addition to the critical vulnerability, SAP addressed other high and medium severity vulnerabilities, including:

Patch The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable instances with the highest priority after thorough testing.

SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape.

Monitor/Detect The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion

In case of an intrusion, you can report an incident via .

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

NVD - SAP SE - SAP SE - GB hackers -