SAP Security Patch Day April 2026: Critical SQL Injection and Authorization Flaws Addressed

#cybersecurity #infosec

Summary

SAP's April 2026 security update addresses 20 vulnerabilities, including a critical SQL injection (CVE-2026-27681) in Business Warehouse and a high-severity authorization bypass (CVE-2026-34256) in S/4HANA.

Take Action:

If you are using SAP products, review the advisory in detail. Prioritize patching the critical SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse, then the high-severity missing authorization check in SAP ERP and SAP S/4 HANA. Then review the rest of the issues.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines