Vulnerabilities · 126 days ago

SAP Commerce flaw opens unauthenticated server-side code execution

Commerce is the more dangerous bug here. A missing authentication check in a cloud configuration path lets an unauthenticated user upload malicious configuration and reach arbitrary server-side code execution, so the usual assumption that only privileged users can trigger SAP admin-side flaws does not hold.

SAP’s May 2026 patch set fixes two critical CVSS 9.6 issues: CVE-2026-34263 in SAP Commerce and CVE-2026-34260 in SAP S/4HANA. The S/4HANA flaw is an authenticated SQL injection with read-only data access, so its impact is limited to confidentiality and availability, not full code execution.

The practical split matters. Commerce exposes a direct execution path on externally reachable instances, while the S/4HANA issue is serious but narrower, so treating both as equal criticals will misread the actual blast radius.

CVE-2026-34263

NVD KEV

CVSS 9.6 CRITICAL: due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious… EPSS 0.6% (44th percentile), up from 0.04%.

CVE-2026-34260

NVD KEV

CVSS 9.6 CRITICAL: sAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. EPSS 0.5% (37th percentile), up from 0.02%.

Timeline

Sources

2 sources covering this story

Entities

Part of the PlainSec briefing for 2026-05-13

Editions

Related stories