CVE-2026-27673: Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise)

Published Apr 14, 2026

Updated

Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated user to delete files on the operating system and gain unauthorized control over file operations which could leads to no impact on Confidentiality, Low impact on Integrity and Availability of the application.

Affected Software

1 affected component

SAP S/4HANA

Event History

Apr 14, 2026

CVE Published

via MITRE·12:06 AM

Data Sourced

via MITRE·12:06 AM

DescriptionSeverity

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-27673?

CVE-2026-27673 is considered a high-severity vulnerability due to its potential to allow unauthorized file operations.

How do I fix CVE-2026-27673?

To fix CVE-2026-27673, ensure that proper authorization checks are implemented for file operations in SAP S/4HANA.

What are the potential risks of CVE-2026-27673?

CVE-2026-27673 may lead to unauthorized deletion of files and control over sensitive file operations, compromising system integrity.

Who is affected by CVE-2026-27673?

CVE-2026-27673 affects authenticated users of SAP S/4HANA in both Private Cloud and On-Premise environments.

Is there a patch available for CVE-2026-27673?

Yes, SAP has released patches and updates to mitigate the risks associated with CVE-2026-27673.