SAP Security Patch Day — April 2026

Tuesday, 14 April 2026

Vulnerabilities: 17
Critical: 1
High: 1
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 1

Critical 9.9
CVE-2026-27681 SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse

All vulnerabilities 17

Critical1 Show

Critical 9.9
CVE-2026-27681 SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse

High1 Show

High 7.1
CVE-2026-34256 Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)

Medium14 Show

Medium 6.5
CVE-2026-27677 Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment)
Medium 6.5
CVE-2026-27678 Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures)
Medium 6.5
CVE-2026-27679 Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures)
Medium 6.5
CVE-2026-34261 Missing Authorization check in SAP Business Analytics and SAP Content Management
Medium 6.5
CVE-2026-34264 Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA
Medium 6.1
CVE-2026-0512 Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)
Medium 6.1
CVE-2026-27674 Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)
Medium 6.1
CVE-2026-34257 Open Redirect vulnerability in SAP NetWeaver Application Server ABAP
Medium 5.0
CVE-2026-34262 Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer
Medium 4.9
CVE-2026-27673 Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise)
Medium 4.3
CVE-2026-27672 Missing Authorization check in Material Master Application
Medium 4.3
CVE-2026-27676 Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures)
Medium 4.2
CVE-2026-24318 Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform
Medium 4.1
CVE-2026-27683 Reflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform

Low1 Show

Low 2.0
CVE-2026-27675 Code Injection vulnerability in SAP Landscape Transformation