Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2026-34263

Missing authentication check in SAP Commerce cloud configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP Commerce cloud configuration

Default version status: unaffected

  • HY_COM 2205affected
  • COM_CLOUD 2211affected
  • 2211-JDK21affected

References