{"id":14381,"date":"2026-04-16T09:34:28","date_gmt":"2026-04-16T07:34:28","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=14381"},"modified":"2026-04-16T09:34:28","modified_gmt":"2026-04-16T07:34:28","slug":"sap-security-notes-april-2026","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/sap-security-notes-april-2026\/","title":{"rendered":"SAP Security Notes, April 2026"},"content":{"rendered":"

Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.<\/strong><\/p>\n\n

\n

 <\/p>\n

April 2026 Notes<\/h2>\n

Monthly Summary and Highlights<\/h3>\n
\n
\n
This month the total number has been 20 notes<\/b> (19 new and 1 update), 5 more than in March. This month 1 Hot News has been published, one less than in the previous period. Regarding high criticality notes, there is 1, the same amount as in March. Medium and low notes will not be reviewed, so we will provide details on a total of 2 notes<\/b> (all those with a CVSS of 7 or higher).<\/div>\n
<\/div>\n
We have a total of 20 notes<\/b> for the whole month (19 are new and 1 is an update of a note from previous months).<\/div>\n
<\/div>\n
We will review in detail a total of 2 notes, all of high criticality and Hot News:<\/div>\n
<\/div>\n
    \n
  1. \n
    The highest criticality note of the month (CVSS <\/b>9.9<\/b><\/span>)<\/b> is a Hot News and is related to “SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse”.<\/b><\/div>\n<\/li>\n
  2. \n
    The second and last note we will review (CVSS <\/b>7.1<\/b><\/span>)<\/b> is of high criticality and covers “Missing Authorization check in SAP ERP and SAP S\/4 HANA (Private Cloud and On-Premise)”.<\/b><\/div>\n<\/li>\n<\/ol>\n
    This month the most predominant type has been “Missing Authorization check”<\/b> (9\/20 in the patch day).<\/div>\n
    In the chart we can see the classification of April’s notes, as well as the evolution and classification of the last 5 previous months (only the notes from Sec. Tuesday \/ Patch Day \u2013 by SAP):<\/div>\n<\/div>\n<\/div>\n

    \"\"<\/p>\n

    Full details<\/h3>\n

    The complete detail of the most relevant notes<\/strong> is as follows:<\/p>\n

      \n
    1. \n
      SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse (<\/b>3719353<\/b><\/a>):<\/b>\u00a0Due\u00a0to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system. A temporary workaround is available. CVSS v3 Base Score <\/b>9,9<\/b><\/span>\/10 [<\/b>CVE-2026-27681<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    2. \n
      Missing Authorization check in SAP ERP and SAP S\/4 HANA (Private Cloud and On-Premise) (<\/b>3731908<\/b><\/a>):<\/b>\u00a0Due to a missing authorization check in SAP ERP and SAP S\/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight\u2011character executable ABAP report without authorization. If the overwritten report is subsequently executed, the intended functionality could become unavailable.\u00a0Successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected. A temporary workaround is available. CVSS v3 Base Score <\/b>7,1<\/b><\/span>\/10 [<\/b>CVE-2026-34256<\/b><\/a>]<\/b><\/div>\n<\/li>\n<\/ol>\n

      Reference links<\/strong><\/h3>\n

      Other references, from SAP and Onapsis (April):<\/p>\n