April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
好的，我现在需要帮用户总结这篇文章的内容，控制在100字以内。首先，我得通读整篇文章，抓住主要信息。 文章主要讲的是四月份的补丁星期二发布了多个关键漏洞，涉及Adobe、Fortinet、Microsoft和SAP的产品。SAP有一个SQL注入漏洞，CVSS评分高达9.9，可能被低权限用户利用执行恶意SQL，导致数据泄露或破坏。Adobe Acrobat Reader也有一个远程代码执行漏洞，评分8.6，并且已经被活跃利用了。此外，还有ColdFusion的五个关键漏洞和FortiSandbox的两个漏洞。微软修复了169个安全缺陷，包括SharePoint的一个欺骗漏洞。其他厂商如AWS、Cisco等也发布了补丁。 接下来，我需要把这些信息浓缩到100字以内。要突出主要厂商及其漏洞的严重性，尤其是高CVSS评分和实际利用情况。同时提到微软和其他厂商的修复措施。 最后，确保语言简洁明了，不使用复杂的术语，并且直接描述内容。 </think> 四月补丁星期二发布多厂商安全更新，SAP修复SQL注入高危漏洞（CVSS 9.9），Adobe Acrobat Reader现远程代码执行（CVSS 8.6），FortiSandbox修复认证绕过及代码执行问题（CVSS 9.1），微软修复169个缺陷包括SharePoint敏感信息泄露。 2026-4-15 12:37:0 Author: thehackernews.com(查看原文) 阅读量:8 收藏

Vulnerability / Data Breach

A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April's Patch Tuesday releases.

Topping the list is an SQL injection vulnerability impacting SAP Business Planning and Consolidation and SAP Business Warehouse (CVE-2026-27681, CVSS score: 9.9) that could result in the execution of arbitrary database commands.

"The vulnerable ABAP program allows a low-privileged user to upload a file with arbitrary SQL statements that will then be executed," Onapsis said in an advisory.

In a potential attack scenario, a bad actor could abuse the affected upload-related functionality to run malicious SQL against BW/BPC data stores, extract sensitive data, and delete or corrupt database content.

"Manipulated planning figures, broken reports, or deleted consolidation data can undermine close processes, executive reporting, and operational planning," Pathlock said. "In the wrong hands, this issue also creates a credible path to both stealthy data theft and overt business disruption."

Another security vulnerability that deserves a mention is a critical-severity remote code execution in Adobe Acrobat Reader (CVE-2026-34621, CVSS score: 8.6) that has come under active exploitation in the wild.

That said, there are many unknowns at this stage. It is not clear how many people have been affected by the hacking campaign. Nor is there any information about who is behind the activity, who is being targeted, and what their motives could be.

Also patched by Adobe are five critical flaws in ColdFusion versions 2025 and 2023 that, if successfully exploited, could lead to arbitrary code execution, application denial-of-service, arbitrary file system read, and security feature bypass.

The vulnerabilities are listed below -

  • CVE-2026-34619 (CVSS score: 7.7) - A path traversal vulnerability leading to security feature bypass
  • CVE-2026-27304 (CVSS score: 9.3) - An improper input validation vulnerability leading to arbitrary code execution
  • CVE-2026-27305 (CVSS score: 8.6) - A path traversal vulnerability leading to arbitrary file system read
  • CVE-2026-27282 (CVSS score: 7.5) - An improper input validation vulnerability leading to security feature bypass
  • CVE-2026-27306 (CVSS score: 8.4) - An improper input validation vulnerability leading to arbitrary code execution

Fixes have also been released for two critical FortiSandbox vulnerabilities that could result in authentication bypass and code execution -

  • CVE-2026-39813 (CVSS score: 9.1) - A path traversal vulnerability in FortiSandbox JRPC API that could allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests. (Fixed in versions 4.4.9 and 5.0.6)
  • CVE-2026-39808 (CVSS score: 9.1) - An operating system command injection vulnerability in FortiSandbox that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. (Fixed in version 4.4.9)

The development comes as Microsoft addressed a staggering 169 security defects, including a spoofing vulnerability impacting Microsoft SharePoint Server (CVE-2026-32201, CVSS score: 6.5) that could allow an attacker to view sensitive information. The company said it's being actively exploited, although there are no insights into the in-the-wild exploitation associated with the bug.

"SharePoint services, especially those used as internal document stores, can be a treasure trove for threat actors looking to steal data, especially data that may be leveraged to force ransom payments using double extortion techniques by threatening to release the stolen data if payment is not made," Kev Breen, senior director of threat research at Immersive, said.

"A secondary concern is that threat actors with access to SharePoint services could deploy weaponised documents or replace legitimate documents with infected versions that would allow them to spread to other hosts or victims moving laterally across the organization."

Software Patches from Other Vendors

In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including —

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.


文章来源: https://thehackernews.com/2026/04/april-patch-tuesday-fixes-critical.html
如有侵权请联系:admin#unsafe.sh