Critical SQLi Hits SAP Business Planning & BW

A critical vulnerability, tracked as CVE-2026-27681, has been identified in SAP Business Planning and Consolidation (BPC) and SAP Business Warehouse (BW). According to the National Vulnerability Database, this flaw stems from insufficient authorization checks, allowing an authenticated user to craft and execute malicious SQL statements.

This isn’t just a garden-variety bug; the National Vulnerability Database has slapped it with a whopping CVSS score of 9.9, classifying it as CRITICAL. The impact is severe, threatening the confidentiality, integrity, and availability of affected systems. We’re talking about a full trifecta hit, where an attacker could read, modify, or even delete sensitive database data. This is a classic CWE-89, SQL Injection, which despite decades of awareness, still rears its ugly head in enterprise software.