CVE-2026-89113: SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-15
Weakness: CWE-89

Description

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.

Affected products

SAP_SE SAP Commerce Cloud (OOTB Code): COM_CLOUD 2211-JDK21

References

https://me.sap.com/notes/3800517
https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-89113 or the next vulnerability affects your stack