CVE-2026-34263

CRITICAL9.6Published on May 12, 2026

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

CVSS score9.6 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-459

SAP Commerce Cloud, CVE-2026-58231 è già sotto attacco: rischio massimo per le installazioni esposte

Vulnerabilities

SAP Commerce Cloud CVE-2026-58231 Already Under Attack: Maximum Risk for Exposed Installations

CVE-2026-58231, a critical SAP Commerce Cloud flaw, is already being targeted in exploitation attempts. Defused, a threat intelligence company, reported

Aug 14, 20264 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

SAP Commerce Cloud CVE-2026-58231 Already Under Attack: Maximum Risk for Exposed Installations