CVE-2026-34263
Received Received - Intake
Improper Spring Security Configuration Leads to Code Injection in SAP Commerce Cloud

Publication date: 2026-05-12

Last updated on: 2026-05-12

Assigner: SAP SE

Description
Due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-12
Last Modified
2026-05-12
Generated
2026-06-21
AI Q&A
2026-05-12
EPSS Evaluated
2026-06-20
NVD
CVE-2026-34263
EUVD
EUVD-2026-29372
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
sap commerce_cloud *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability arises from improper configuration of Spring Security in SAP Commerce cloud. It allows an unauthenticated user to upload malicious configurations and inject code into the system.

As a result, the attacker can execute arbitrary server-side code, which means they can run any commands or programs on the server without authorization.

Impact Analysis

The vulnerability can have a high impact on the Confidentiality, Integrity, and Availability of the affected application.

  • Confidentiality: Sensitive data could be exposed or stolen.
  • Integrity: Data or configurations could be altered maliciously.
  • Availability: The application or server could be disrupted or taken down.
Compliance Impact

This vulnerability allows unauthenticated users to perform malicious configuration uploads and code injection, resulting in arbitrary server-side code execution. Such a compromise can lead to a high impact on the confidentiality, integrity, and availability of the application.

Given the high impact on confidentiality and integrity, this vulnerability could potentially lead to non-compliance with standards and regulations such as GDPR and HIPAA, which require strict protection of sensitive data and system integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart