SAP Commerce flaw opens unauthenticated server-side code execution
Commerce is the more dangerous bug here. A missing authentication check in a cloud configuration path lets an unauthenticated user upload malicious configuration and reach arbitrary server-side code execution, so the usual assumption that only privileged users can trigger SAP admin-side flaws does not hold.
SAP’s May 2026 patch set fixes two critical CVSS 9.6 issues: CVE-2026-34263 in SAP Commerce and CVE-2026-34260 in SAP S/4HANA. The S/4HANA flaw is an authenticated SQL injection with read-only data access, so its impact is limited to confidentiality and availability, not full code execution.
The practical split matters. Commerce exposes a direct execution path on externally reachable instances, while the S/4HANA issue is serious but narrower, so treating both as equal criticals will misread the actual blast radius.