CVE-2026-34263
CVSS 9.6 CRITICAL: due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious… EPSS 0.6% (44th percentile), up from 0.04%.
Vulnerabilities · 126 days ago
Commerce is the more dangerous bug here. A missing authentication check in a cloud configuration path lets an unauthenticated user upload malicious configuration and reach arbitrary server-side code execution, so the usual assumption that only privileged users can trigger SAP admin-side flaws does not hold.
SAP’s May 2026 patch set fixes two critical CVSS 9.6 issues: CVE-2026-34263 in SAP Commerce and CVE-2026-34260 in SAP S/4HANA. The S/4HANA flaw is an authenticated SQL injection with read-only data access, so its impact is limited to confidentiality and availability, not full code execution.
The practical split matters. Commerce exposes a direct execution path on externally reachable instances, while the S/4HANA issue is serious but narrower, so treating both as equal criticals will misread the actual blast radius.
CVSS 9.6 CRITICAL: due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious… EPSS 0.6% (44th percentile), up from 0.04%.
CVSS 9.6 CRITICAL: sAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. EPSS 0.5% (37th percentile), up from 0.02%.
2 sources covering this story
SAP Patches Critical S/4HANA, Commerce Vulnerabilities
The flaws could allow attackers to inject malicious code, leading to information disclosure and code execution.
SAP fixes critical vulnerabilities in Commerce Cloud and S/4HANA
SAP has released the May 2026 security updates addressing 15 vulnerabilities across multiple products, including two critical flaws in the Commerce Cloud enterprise-grade e-commerce platform and the S/4HANA ERP suite.
Part of the PlainSec briefing for 2026-05-13