CVE-2026-27684: SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification)
SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through user-controlled input fields. The application concatenates these inputs directly into SQL queries without proper validation or escaping. As a result, an attacker can manipulate the WHERE clause logic and potentially gain unauthorized access to or modify database information. This vulnerability has no impact on integrity and low impact on the confidentiality and availability of the application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27684?
CVE-2026-27684 is classified as a high-severity SQL injection vulnerability.
How do I fix CVE-2026-27684?
To fix CVE-2026-27684, apply the relevant security patches provided by SAP for NetWeaver.
What systems are affected by CVE-2026-27684?
CVE-2026-27684 affects the SAP NetWeaver platform, specifically the Feedback Notifications Service.
Can CVE-2026-27684 be exploited remotely?
CVE-2026-27684 requires authenticated access, allowing an attacker to exploit the vulnerability via user-controlled input fields.
What are the potential consequences of exploiting CVE-2026-27684?
Exploiting CVE-2026-27684 can allow an attacker to execute arbitrary SQL code, potentially compromising the integrity of the database.