CVE-2026-89113: SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated to SAP Commerce Cloud and able to send specially crafted requests to the affected functionality. No user interaction is required.
What could an attacker do after successful exploitation?
An attacker could inject arbitrary SQL commands into database queries. This may allow them to read, modify, or delete sensitive application database data.
Is this exploitable remotely?
Yes. The attack vector is network-based, meaning exploitation can be performed through network access to the affected SAP Commerce Cloud functionality, provided the attacker has valid authentication.