CVE-2026-27686CWE-862

Missing Authorization check in SAP Business Warehouse (Service API)

Medium · published March 10, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00298 · 21.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-03-10T00:18Z
EPSS history
Timeline
  • 10 MAR 00:18Z
    Missing Authorization check in SAP Business Warehouse (Service API)
    cvelistv5