CVE-2026-27684CWE-89

SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification)

Medium · published March 10, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through user-controlled input fields. The application concatenates these inputs directly into SQL queries without proper validation or escaping. As a result, an attacker can manipulate the WHERE clause logic and potentially gain unauthorized access to or modify database information. This vulnerability has no impact on integrity and low impact on the confidentiality and availability of the application.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-10T00:18Z
EPSS history
Timeline
  • 10 MAR 00:18Z
    SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification)
    cvelistv5