CVE-2026-27681 is the highest-severity vulnerability in SAP’s April 2026 Security Patch Day, carrying a CVSS score of 9.9. It is a SQL injection in SAP Business Planning and Consolidation (BPC) and BW/4HANA — the financial consolidation and business intelligence platforms that form the reporting and planning backbone for thousands of enterprise SAP customers. The exploit requires nothing beyond a standard low-privilege SAP user account.
The Vulnerability
An authenticated user with minimal SAP access privileges can craft ABAP queries targeting BPC or BW table layers that bypass SAP’s authorisation object checks. Successful exploitation gives the attacker direct SQL execution capability against the underlying database, with the full confidentiality, integrity, and availability impact that entails:
- Read: access to financial records, cost centre data, budget figures, revenue forecasts, management accounts — any data in the BPC/BW data layer
- Modify: alteration of financial records, manipulation of consolidation data, change of reported figures in advance of period-end reporting processes
- Delete: destruction of financial history, erasure of audit trails, corruption of BW InfoCubes
The 0.1 point separation from a perfect CVSS 10.0 reflects the authentication requirement. In practice, most SAP BPC environments are accessed by hundreds to thousands of users, including users in finance, controlling, and planning functions who have no legitimate reason to perform the operations this vulnerability enables. The threshold for exploitation is “valid SAP credentials” — a credential category that is regularly stolen in phishing campaigns targeting finance teams.
Why SAP Gets Treated Differently — and Shouldn’t
SAP has historically occupied an unusual position in enterprise security programmes. Security teams often treat SAP as an application managed entirely by the SAP Basis team, outside the scope of standard vulnerability management processes. SAP patches are applied on SAP Basis timelines, which often lag IT security patching schedules significantly.
This separation is a governance risk. When a CVE 9.9 is disclosed affecting Windows or Exchange, vulnerability management programmes mobilise to patch within days. The same urgency does not typically apply to SAP — despite SAP managing financial, HR, supply chain, and procurement data that is operationally and regulatorily critical.
CVE-2026-27681 is an instructive example of the risk that gap creates. A threat actor who obtains a low-privilege SAP user credential — through phishing an accounts payable clerk, credential stuffing, or purchasing credentials from an initial access broker — has SQL execution capability against financial consolidation data in unpatched environments.
Business Risk Framing
The business risk of this vulnerability extends beyond technical compromise:
- Financial reporting integrity: An attacker with SQL write access to BPC can modify consolidated figures. Depending on when in a reporting cycle this occurs, manipulated data could propagate into financial statements, management reports, or regulatory filings before detection.
- Audit trail manipulation: BPC/BW change logs and audit trails are stored in the same database layer accessible via this exploit. An attacker can cover tracks by deleting or modifying the log records that would document the tampering.
- Regulatory exposure: Organisations subject to SOX, DORA, or similar frameworks with financial data integrity requirements face both the underlying breach and potential regulatory notification obligations if financial data is confirmed to have been accessed or modified.
Recommended Actions
- Apply SAP April 2026 Security Patch Day notes to all BPC and BW/4HANA systems immediately — development, QA, and production landscapes. Confirm with SAP Basis that the patch note is applied and transport imported to production.
- Audit SAP user accounts: Review and restrict SAP BPC/BW authorisation objects to least-privilege. Users who need read-only access to reports should not have execute rights against BPC planning functions.
- Review SAP application logs for anomalous query patterns — particularly any ABAP query execution by users who do not normally execute direct table-level queries.
- Include SAP in vulnerability management scope: CVEs affecting SAP should be tracked and remediated under the same priority framework as other enterprise software. If your vulnerability management programme does not currently have SAP systems in scope, this is the prompt to change that.
- Engage SAP Basis for immediate prioritisation: Confirm the patch timeline for production systems. For environments where immediate patching is not possible, restrict BPC/BW access to only users with a documented operational requirement until the patch is applied.
Share this article