What’s Vulnerable › Vulnerabilities

CVE-2026-34263: Missing authentication check in SAP Commerce cloud configuration

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-12 · updated 2026-10-26
• Weakness: CWE-459

Description

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

Affected products

• SAP_SE SAP Commerce cloud configuration: HY_COM 2205, COM_CLOUD 2211, 2211-JDK21

References

• https://me.sap.com/notes/3733064
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-34263 or the next vulnerability affects your stack