Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-27686Missing Authorization check in SAP Business Warehouse (Service API)

Description

Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.

Timeline

  1. ID reserved

    By sap

  2. · 15 days later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-27686, by who scored it
Scored byCVSSScoreVector
sapCNA (assigner)3.1Medium5.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
NVDNVD · Awaiting Analysis3.1Medium5.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS (exploitation in 30 days)
0.25% · top 83% of all CVEs (14 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Affected products

  • SAP_SE · SAP Business Warehouse (Service API)

    • affected DW4CORE 200
    • affected 300
    • affected 400
    • affected PI_BASIS 2006_1_700
    • affected 701
    • affected 702
    • affected 730
    • affected 731
    • affected 740
    • affected SAP_BW 750
    • affected 751
    • affected 752
    • affected 753
    • affected 754
    • affected 755
    • affected 756
    • affected 757
    • affected 758
    • affected 816

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-27686 badge
[![CVE-2026-27686](https://cveledger.app/badge/CVE-2026-27686.svg)](https://cveledger.app/cve/CVE-2026-27686)

Record last updated .