{"id":609,"date":"2026-04-15T14:57:22","date_gmt":"2026-04-15T14:57:22","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=609"},"modified":"2026-04-15T14:57:22","modified_gmt":"2026-04-15T14:57:22","slug":"april-patch-tuesday-fixes-critical-flaws-across-sap-adobe-microsoft-fortinet-and-more","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=609","title":{"rendered":"April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 15, 2026<\/span><\/span>Vulnerability \/ Data Breach<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A number\u00a0of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April’s Patch Tuesday\u00a0releases.<\/p>\n

Topping the list is an SQL injection vulnerability impacting SAP Business Planning and Consolidation and SAP Business Warehouse\u00a0(CVE-2026-27681<\/a>, CVSS score: 9.9) that could result in the execution of arbitrary database\u00a0commands.<\/p>\n

\u00abThe vulnerable ABAP program allows a low-privileged user to upload a file with arbitrary SQL statements that will then be executed,\u00bb\u00a0Onapsis said<\/a> in an\u00a0advisory.<\/p>\n

In a potential attack scenario, a bad actor could abuse the affected upload-related functionality to run malicious SQL against BW\/BPC data stores, extract sensitive data, and delete or corrupt database\u00a0content.<\/p>\n

\u00abManipulated planning figures, broken reports, or deleted consolidation data can undermine close processes, executive reporting, and operational planning,\u00bb\u00a0Pathlock said<\/a>. \u00abIn the wrong hands, this issue also creates a credible path to both stealthy data theft and overt business disruption.\u00bb<\/p>\n

Another security vulnerability that deserves a mention is a critical-severity remote code execution in Adobe Acrobat Reader\u00a0(CVE-2026-34621, CVSS score: 8.6) that has come under active exploitation in the\u00a0wild.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

That said, there are many unknowns at this stage. It\u00a0is not clear how many people have been affected by the hacking campaign. Nor\u00a0is there any information about who is behind the activity, who is being targeted, and what their motives could\u00a0be.<\/p>\n

Also patched<\/a> by Adobe\u00a0are five critical flaws in ColdFusion versions 2025 and\u00a02023<\/a> that, if successfully exploited, could lead to\u202farbitrary code execution, application denial-of-service, arbitrary file system read, and security feature\u00a0bypass.<\/p>\n

<\/p>\n

The vulnerabilities are listed below\u00a0–<\/p>\n