CVE-2026-27684: SAP NetWeaver SQL Injection Vulnerability

CVE-2026-27684 Overview

CVE-2026-27684 is a SQL injection vulnerability [CWE-89] in the SAP NetWeaver Feedback Notifications Service. The service concatenates user-controlled input directly into SQL queries without proper validation or escaping. An authenticated attacker with low privileges can inject arbitrary SQL code through input fields. The injection allows manipulation of WHERE clause logic, leading to unauthorized read or modification of database information. The flaw has a scope-changed impact with low confidentiality and availability consequences, and no integrity impact.

Critical Impact

Authenticated attackers can manipulate SQL WHERE clause logic to access or modify backend database records served by the SAP NetWeaver Feedback Notifications Service.

Affected Products

• SAP NetWeaver Feedback Notifications Service
• Refer to SAP Note #3697355 for affected versions
• Refer to SAP Security Patch Day for advisory details

Discovery Timeline

• 2026-03-10 - CVE-2026-27684 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-27684

Vulnerability Analysis

The SAP NetWeaver Feedback Notifications Service accepts user-supplied input through application fields and passes the values into SQL statements without sanitization. The vulnerable code path concatenates attacker-controlled strings into a query rather than binding them as parameters. This pattern is a textbook SQL injection weakness classified under [CWE-89].

Because the attacker must authenticate before reaching the vulnerable endpoint, exploitation requires valid credentials at any privilege tier. After authentication, the attacker submits crafted payloads that break out of the intended string context and append additional SQL logic. The scope change indicator reflects that the injected query executes against database resources beyond the immediate service boundary.

The disclosed impact is limited to partial information disclosure and partial availability degradation, with no integrity impact. This profile is consistent with an injection point reachable in a read-oriented WHERE clause rather than in INSERT or UPDATE paths.

Root Cause

The root cause is the construction of SQL statements through string concatenation of unvalidated user input. The application does not apply prepared statements, parameter binding, or input allow-listing before executing the query against the database.

Attack Vector

The attack is delivered over the network against the Feedback Notifications Service. An authenticated user submits malicious input in fields that flow into a SQL WHERE clause. The injected payload modifies query logic to return additional rows, bypass row-level filters, or trigger expensive operations that degrade service availability. No verified proof-of-concept code is publicly available; refer to SAP Note #3697355 for technical specifics.

Detection Methods for CVE-2026-27684

Indicators of Compromise

• HTTP requests to the Feedback Notifications Service containing SQL metacharacters such as ', --, ;, UNION, or OR 1=1 in parameter values
• Database audit logs showing malformed or unexpected WHERE clause structures originating from the NetWeaver application user
• Anomalous spikes in query volume or query duration tied to feedback notification endpoints
• Authentication events followed by repeated 500-class responses from the Feedback Notifications Service

Detection Strategies

• Inspect web application firewall and reverse proxy logs for SQL injection signatures targeting NetWeaver URLs
• Correlate authenticated session identifiers with database query patterns to surface a single user issuing varied injection probes
• Enable SAP database tracing and review parameterized vs. concatenated query execution for the Feedback Notifications module

Monitoring Recommendations

• Forward SAP NetWeaver application and HTTP access logs to a centralized analytics platform for query-pattern analysis
• Alert on UNION SELECT, stacked queries, and time-based injection primitives (SLEEP, WAITFOR DELAY) in inbound parameters
• Monitor privileged database account activity initiated by the NetWeaver service for unexpected schema enumeration

How to Mitigate CVE-2026-27684

Immediate Actions Required

• Apply the patch referenced in SAP Note #3697355 at the earliest scheduled maintenance window
• Review SAP account inventories and remove or rotate credentials for unused or stale users that could reach the service
• Audit recent Feedback Notifications Service traffic for injection attempts predating the patch

Patch Information

SAP released a fix as part of SAP Security Patch Day. Customers should consult SAP Note #3697355 for the corrected component versions and download instructions, and the SAP Security Patch Day portal for the full advisory bundle.

Workarounds

• Restrict network reachability to the Feedback Notifications Service to trusted internal subnets only
• Deploy a web application firewall rule set that blocks common SQL injection payloads on the affected endpoints
• Reduce database privileges for the NetWeaver service account to the minimum required for feedback operations
• Increase logging verbosity on the affected endpoints until the patch is deployed