SAP Commerce Cloud: SQL injection via list API input
Summary
SAP Commerce Cloud (OOTB Code) does not sufficiently validate certain input parameters before they are used in database queries, which allows SQL injection. An authenticated user with access to the affected list APIs can send crafted requests to read, modify or delete data in the application database. SAP rates the flaw High (CVSS 8.8), and the impact on confidentiality, integrity and availability is rated high.
Affected
- SAP Commerce Cloud (OOTB Code), COM_CLOUD 2211-JDK21
- Default configuration: unaffected
- Other branches and JDK versions: Unknown. Check SAP Note 3800517 for the exact affected release list.
Fixed in
- Patch to 2211-jdk21.18 or later (according to secondary sources; verify in SAP Note 3800517)
- Rebuild and redeploy the application after applying the patch
Workaround
Unknown. Sources differ on a temporary workaround. If patching is delayed, obtain the exact steps from SAP Note 3800517. Limiting access to the affected list APIs is a reasonable interim control (own assessment, not a vendor instruction).
Exploitation
- SAP reports no exploitation in the wild.
- No confirmed public proof of concept found.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV at the time of research; recheck before relying on this.
Our recommendation
- Identify all SAP Commerce Cloud instances and confirm the build version.
- Apply the patch from SAP Note 3800517 with rebuild and redeploy.
- Review which accounts (customer, partner or internal) can call the affected list APIs and remove unnecessary access.
- Monitor logs for unusual query parameters until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- SAP Note 3800517 me.sap.com
- SAP Security Patch Day url.sap
- SAP Security Notes October 2026 support.sap.com
- RedRays: SAP Security Patch Day October 2026 redrays.io
- Pathlock: SAP Patch Day October 2026 pathlock.com
- Onapsis: SAP Security Patch Day October 2026 onapsis.com
- Inprosec: SAP Security Notes October 2026 www.inprosec.com
- VulDB: CVE-2026-89113 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:16.
Original description (NVD)
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.
NVD references (2)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.