CVE-2026-27679

CVE-2026-27679 is a missing authorization vulnerability in SAP S/4HANA's frontend OData Service for the Manage Reference Structures module. An attacker with valid credentials could exploit exposed OData services to unauthorized update and delete child entities, compromising data integrity within the system. The vulnerability affects confidentiality and availability minimally, with the primary risk centered on unauthorized data modification. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and low privileges to exploit. While the authorization gap presents a significant integrity risk, the attack requires user authentication and does not provide pathways to compromise confidentiality or system availability. The FAUCET risk score of 35.0/100 indicates moderate organizational risk despite the medium CVSS rating. There are currently no indicators of active exploitation, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on security hot lists. The extremely low EPSS score of 0.00029 suggests minimal real-world exploitation activity to date. However, organizations should prioritize patching given the moderate risk profile and the straightforward nature of authorization bypass vulnerabilities, which typically attract attention once disclosure accelerates.