CVE-2026-27686 — Missing Authorization check in SAP Business Warehouse (Service API)

Description (CNA)

Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Business Warehouse (Service API)	affected DW4CORE 200; affected 300; affected 400; affected PI_BASIS 2006_1_700; affected 701; affected 702; affected 730; affected 731; affected 740; affected SAP_BW 750; affected 751; affected 752; affected 753; affected 754; affected 755; affected 756; affected 757; affected 758; affected 816

CWE

CWE-862

References

https://me.sap.com/notes/3703385
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.