CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

SAP Commerce Cloud, unauthenticated arbitrary code execution via Spring Security misordering on cloud-config endpoint (CVSS 9.6, SAP Note 3733064)

cve · CVE-2026-34263

Coverage
1
first 2026-05-13 → last 2026-10-21
Latest activity
2026-05-13
SAP patches unauthenticated code execution in Commerce Cloud and authenticated SQL injection in S/4HANA search
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
6
5 hosts

Defender insights

What each entry about CVE-2026-34263 tells a defender to do, newest first.

2026-05-13NOTABLESAP patches unauthenticated code execution in Commerce Cloud and authenticated SQL injection in S/4HANA search

Exposure

Story timeline

  1. 2026-05-13CVE-2026-34263 and CVE-2026-34260: SAP Commerce Cloud unauthenticated code injection and S/4HANA Enterprise Search SQL injection (May 2026 Patch Day)
    trending-vulnerabilitiesSAP patches unauthenticated code execution in Commerce Cloud and authenticated SQL injection in S/4HANA search

Hunting pivots

Affected products
SAP Commerce CloudSAP S/4HANA
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-13/cve-2026-34263-cve-2026-34260-sap-commerce-cloud-pre-auth-rc · ATT&CK page ↗

Entries about SAP Commerce Cloud, unauthenticated arbitrary code execution via Spring Security misordering on cloud-config endpoint (CVSS 9.6, SAP Note 3733064) (1)

2026-05-13 · view entry permalink →

NOTABLECVE-2026-34263 +1updatedNATOA2

CVE-2026-34263 and CVE-2026-34260: SAP Commerce Cloud unauthenticated code injection and S/4HANA Enterprise Search SQL injection (May 2026 Patch Day)

SAP released its May 2026 security notes on 2026-05-12, among them Note 3733064 for CVE-2026-34263 in SAP Commerce Cloud (HY_COM 2205, COM_CLOUD 2211 and 2211-JDK21) and Note 3724838 for CVE-2026-34260 in SAP S/4HANA's Enterprise Search for ABAP (SAP_BASIS 751 to 758 and 816), both rated Critical at CVSS 9.6 (SAP, May 2026); Onapsis counts seventeen new and updated notes, three of them HotNews (Onapsis, 2026-05-12). CVE-2026-34263 stems from improper Spring Security configuration that lets an unauthenticated user perform malicious input injection resulting in arbitrary server-side code execution (EUVD-2026-29372); Onapsis traces it to an overly permissive security configuration with improper rule ordering that allows malicious configuration upload and code injection (Onapsis, 2026-05-12), and SAP's vector requires user interaction (SAP, May 2026). CVE-2026-34260 lets an authenticated attacker inject SQL through user-controlled input that the application concatenates into its queries (EUVD-2026-29371); the affected code only allows reading data, so confidentiality and availability are affected but integrity is not (Onapsis, 2026-05-12). The cycle's third HotNews note, 3747787 of 2026-04-30, covers the variant of the Shai-Hulud worm that injected malicious code into SAP Cloud Application Programming npm packages available for two to four hours on 2026-04-29 (Onapsis, 2026-05-12). SAP makes no mention of exploitation in the wild (SecurityWeek, 2026-05-12).

The vulnerability is caused by an overly permissive security configuration with improper rule ordering, allowing an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution.

Fortunately, the affected source code only allows read access to data so that integrity is not impacted.

Onapsis 2026-05-12

SAP makes no mention of any of these vulnerabilities being exploited in the wild, but users are advised to apply the patches as soon as possible.

SecurityWeek 2026-05-12
Correctionrun 2026-10-21T1148Z-auditactionsaffected_productsbodyclassificationcvesevidenceheadlineprioritysourcessourcing_notesummarytechniquestitle

CVE-2026-34260 needs authentication: it is an SQL injection through user-controlled input in S/4HANA's Enterprise Search for ABAP (EUVD-2026-29371), and because the affected code only reads data its integrity impact is none, so the reach is database reads and availability rather than full read and write (Onapsis, 2026-05-12). CVE-2026-34263 in Commerce Cloud needs no authentication but SAP's vector requires user interaction (SAP, May 2026), and its root cause is improper Spring Security configuration (EUVD-2026-29372). HotNews Note 3747787 for the SAP Cloud Application Programming npm compromise was released on 2026-04-30 (Onapsis, 2026-05-12), and none of the cited sources links either product to Swiss federal programmes or says how often Commerce Cloud deployments face the internet.

vulnerability13 May 05:00Zmulti-sourceOpen finding →
Sources: Onapsis · SecurityWeek · NCSC-CH Security Hub #12565 · SAP Security Patch Day, May 2026 · ENISA EUVD (EUVD-2026-29372, CVE-2026-34263) · ENISA EUVD (EUVD-2026-29371, CVE-2026-34260)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • euvd.enisa.europa.eu2 (33%)
  • onapsis.com1 (17%)
  • security-hub.ncsc.admin.ch1 (17%)
  • securityweek.com1 (17%)
  • support.sap.com1 (17%)

External references

NVD · cve.org · CISA KEV

All cited sources (6)