SQL Injection Vulnerability in SAP NetWeaver Feedback Notifications Service

CVE-2026-27684

What is CVE-2026-27684?

The SAP NetWeaver Feedback Notifications Service is susceptible to a SQL injection vulnerability that arises from improper handling of user inputs. An authenticated attacker can exploit this flaw by injecting arbitrary SQL commands through input fields directly, as the application fails to validate or escape these inputs before integrating them into SQL queries. This could allow unauthorized access to or modification of database information, thereby posing a significant risk to the application's security posture.

References