CRITICAL CWE-459
CVE-2026-34263
Missing authentication check in SAP Commerce cloud configuration
SAP·Commerce cloud configuration
9.6/ 10
CVSS 3.1
Critical severity
0.61%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 50% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- May 12, 2026
- Updated
- May 15, 2026
- First covered
- Aug 16, 2026
- Latest story
- 3 months ago
Summary
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.
CWE-459Incomplete Cleanup
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HAffected products
- SAP Commerce cloud configurationHY_COM 2205COM_CLOUD 22112211-JDK21