CVE-2026-27677

CVE-2026-27677 is an authorization bypass vulnerability in SAP S/4HANA's OData Service for managing reference equipment that permits attackers to unauthorized update and delete child entities. The flaw stems from missing authorization checks within the affected OData service module, creating a direct integrity risk to data managed through this interface. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and only low-level user privileges to exploit. Integrity impact is rated as high, while confidentiality and availability are unaffected. The FAUCET Risk Score of 35.0/100 indicates moderate overall risk in the organization's threat landscape. Current exploitation status indicates the vulnerability is not actively being exploited in the wild. The vulnerability does not appear on the CISA KEV catalog and remains inactive on community hot lists, suggesting limited public awareness or exploit availability at this time. However, organizations running affected SAP S/4HANA systems should still prioritize patching given the integrity impact and the low privilege requirements for exploitation.