CVE-2026-89113

EUVD-2026-98195

13.10.2026, 01:16

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.

SQL Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 26.6%

Common Weakness Enumeration

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Vulnerability Media Exposure

[GERMAN] SAP Patch-Day Oktober 2026: Drei HotNews und Korrekturen für S/4HANA
SAP hat zum Patch-Day im Oktober 21 neue und aktualisierte Sicherheitshinweise veröffentlicht. Darunter befinden sich drei HotNews-Hinweise, einer davon betrifft eine Code-Injection-Schwachstelle in S/4HANA. Die Onapsis Research Labs waren an der Behebung von zehn Schwachstellen beteiligt. Der Beitrag SAP Patch-Day Oktober 2026: Drei HotNews und Korrekturen für S/4HANA erschien zuerst auf All About Security Das Online-Magazin zu Cybersecurity (Cybersicherheit). Ransomware, Phishing, IT-Sicherheit, Netzwerksicherheit, KI, Threats, DDoS, Identity & Access, Plattformsicherheit .
Published: 2026-10-14T10:56:18+00:00

References

https://me.sap.com/notes/3800517

https://url.sap/sapsecuritypatchday