CVE-2026-34263 — Missing authentication check in SAP Commerce cloud configuration

CVE-2026-34263

Missing authentication check in SAP Commerce cloud configuration PUBLISHED

Description (CNA)

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Commerce cloud configuration	affected HY_COM 2205; affected COM_CLOUD 2211; affected 2211-JDK21

CWE

CWE-459

References

https://me.sap.com/notes/3733064
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.