April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
Summary: April's Patch Tuesday releases address critical vulnerabilities in SAP, Adobe, Microsoft, and Fortinet products, led by an SQL injection flaw in SAP Business Planning and Consolidation and SAP Business Warehouse (CVE-2026-27681, CVSS 9.9) that lets a low-privileged user upload a file with arbitrary SQL statements for execution. Adobe patched a critical remote code execution flaw in Acrobat Reader (CVE-2026-34621, CVSS 8.6) under active exploitation with unknown scope and actors, while Microsoft addressed 169 security defects including an actively exploited SharePoint Server spoofing vulnerability (CVE-2026-32201, CVSS 6.5).
Why it matters: The SAP flaw carries a 9.9 severity and lets a low-privileged user run arbitrary SQL against BW/BPC data stores, a path to both stealthy data theft and deleted consolidation data that undermines close processes and executive reporting. The Acrobat Reader flaw is already being exploited in the wild, and no one has said how many are affected or who is behind it.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-27681CVE-2026-32201CVE-2026-34621
- Related
- Patch Tuesday, April 2026 Edition Cyber Risks ·CVE-2026-32201: Microsoft Share Point Server Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Apr 14, 2026