CVE Intelligence
Analysis AI-assisted

CVE-2026-34263: SAP Commerce Cloud Spring Security Misconfiguration Leading to Code Injection

SAP Commerce Cloud is affected by CVE-2026-34263, caused by improper Spring Security configuration. According to the CNA record, an unauthenticated user may inject malicious input that results in arbitrary server-side code execution. The CNA scores it 9.6 (critical) under CVSS 3.1, and the record does not yet list affected versions or fixes.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SAP has published CVE-2026-34263 for SAP Commerce Cloud. The CNA description attributes the issue to improper Spring Security configuration, which allows an unauthenticated user to inject malicious input and reach arbitrary server-side code execution.

Impact

  • The CNA describes a high impact on confidentiality, integrity and availability of the application.
  • The CNA-provided CVSS 3.1 score is 9.6 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
  • Inference: the description says no authentication is required, but the vector also lists user interaction and a scope change, so the exact preconditions should be confirmed in SAP's own note.

Affected products and versions

The record names SAP Commerce Cloud but lists no affected product versions or version ranges. Affected versions are unknown from the sources consulted. Check SAP Note 3733064 for SAP's authoritative list.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation appears in the sources consulted. The EPSS record shows a probability of 0.00621 and a percentile of 0.48369; these are estimates, not evidence of exploitation.

Remediation and mitigation

  • Review the SAP Security Patch Day information and SAP Note 3733064 for the applicable correction.
  • Prioritize patching given the critical CVSS score, even though no fixed version is listed in the record.
  • Until patched, review how Spring Security is configured in your deployments and limit exposure of unauthenticated endpoints where feasible.

Detection guidance

  • Monitor web and application logs for unusual or malformed input directed at Commerce endpoints.
  • Alert on unexpected process creation or outbound connections from Commerce application servers.

Limitations of the available information

  • No affected or fixed versions are listed in the record.
  • The CWE entry (CWE-459) has no name in the record.
  • The EPSS date recorded (2026-10-13) is later than the publication date and should be verified.
  • Technical details of the injection vector are not provided, and this analysis does not describe them.

Frequently asked questions

Is CVE-2026-34263 being actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

What is the severity of CVE-2026-34263?

The CNA assigns a CVSS 3.1 score of 9.6 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Which versions are affected and where is the fix?

The record does not list affected or fixed versions. Check SAP Note 3733064 and the SAP Security Patch Day page for official information.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.