PT-2026-39922 · Sap · Sap Commerce Cloud

Published 2026-05-11 · Updated 2026-06-09 · CVE-2026-34263

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP Commerce cloud (affected versions not specified)

Description Improper Spring Security configuration allows an unauthenticated user to perform malicious configuration upload and code injection. This can result in arbitrary server-side code execution, significantly impacting the confidentiality, integrity, and availability of the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-459

Related Identifiers

BDU:2026-06822

CVE-2026-34263

Affected Products

Sap Commerce Cloud

References · 22

• https://bdu.fstec.ru/vul/2026-06822 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34263 · Security Note
• https://twitter.com/NetSecIO/status/2054928622259986834 · Twitter Post
• https://twitter.com/ThreatLevelAI/status/2054661212131016875 · Twitter Post
• https://decryptiondigest.com/blog/sap-cve-2026-34263-commerce-cloud-rce-s4hana-sqli · Note
• https://twitter.com/abokfelix/status/2054790838329242083 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054125539284177299 · Twitter Post
• https://twitter.com/CCBalert/status/2054494865451270352 · Twitter Post
• https://twitter.com/ToolsLib/status/2054862918101963005 · Twitter Post
• https://t.me/CVEtracker/53449 · Telegram Post
• https://me.sap.com/notes/3733064 · Note
• https://twitter.com/0x2ed3bb60/status/2054045335727825406 · Twitter Post
• https://twitter.com/threadlinqs/status/2054237120819015707 · Twitter Post
• https://twitter.com/ElusivePrivacy/status/2054348059169935779 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1tgnuvb/critical_security_flaws_found_in_ivanti_fortinet · Reddit Post