CVE-2026-34263 - Missing authentication check in SAP Commerce cloud configuration · CoreCVE

Back Back to CVE browser

CRITICAL

Missing authentication check in SAP Commerce cloud configuration

Published May 12, 2026

9.6

CRITICAL

CVSS 3.1

EPSS 0.62%

Description

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

Affected products

Vendor SAP SE Product SAP Commerce cloud configuration Default
unaffected
Affected
- 2211-JDK21
- COM_CLOUD 2211
- HY_COM 2205

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
SAP SE	SAP Commerce cloud configuration	unaffected	Affected 2211-JDK21 COM_CLOUD 2211 HY_COM 2205

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-459

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29372		Advisory
https://me.sap.com/notes/3733064
https://url.sap/sapsecuritypatchday

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sap

Published May 12, 2026

Updated May 15, 2026

Reserved Mar 26, 2026

Link CVE-2026-34263

CISA Vulnrichment

Updated May 12, 2026

NVD

Status Awaiting Analysis

Modified Jun 17, 2026

Link CVE-2026-34263

Red Hat

No data

ENISA EUVD

Assigner sap

Published May 12, 2026

Updated May 15, 2026

Link EUVD-2026-29372

GitHub

No data