CVE-2026-89113
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.
Risk Assessment
An attacker with application access can gain full control over database data, potentially leading to data leakage, modification, or deletion, causing significant harm to the organization.
Recommendation
Apply patches from SAP for SAP Commerce Cloud. Additionally, implement SQL injection prevention mechanisms such as parameterized queries and input validation.
Other vulnerabilities in SAP Commerce Cloud
See all- CVE-2026-58231Critical
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability.
- CVE-2026-44761Critical
SAP Commerce Cloud may retain a sample OAuth2 client with publicly documented sample credentials from sample configuration in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.
- CVE-2026-34263Critical
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution.
- CVE-2019-0344CriticalActively exploited
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
- CVE-2025-42906Medium
SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could bypass configured access restrictions, resulting in a low impact on confidentiality, with no impact on integrity or availability.
- CVE-2023-39439High
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
Original NVD description (English source)
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS