CVE-2026-34263 Missing authentication check in SAP Commerce cloud configuration
Unauthenticated attackers can inject malicious input to execute arbitrary code due to missing authentication checks in SAP Commerce Cloud.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-34263?
CVE-2026-34263 is a critical missing authorization vulnerability in SAP_SE SAP Commerce cloud configuration, published on 12 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.
Weakness: CWE-459
Which versions are affected by CVE-2026-34263?
How do I fix CVE-2026-34263?
No fix has been published for CVE-2026-34263 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-34263 being exploited?
There is no known exploitation of CVE-2026-34263 in the wild and no public exploit code.
Sources
Also known as GHSA-wxxf-gjw8-32x8.