What’s Vulnerable › Vulnerabilities

CVE-2026-27686: Missing Authorization check in SAP Business Warehouse (Service API)

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-10 · updated 2026-06-17
• Weakness: CWE-862

Description

Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.

Affected products

• SAP_SE SAP Business Warehouse (Service API): DW4CORE 200, 300, 400, PI_BASIS 2006_1_700, 701, 702 (+13)

References

• https://me.sap.com/notes/3703385
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-27686 or the next vulnerability affects your stack