CVE-2026-34263CRITICAL 9.6EPSS p44.5%

CVE-2026-34263CVE-2026-34263

Description

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

Scoring

CVSS 3.19.6 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS0.61% probability of exploitation · percentile 44.5% · 2026-06-19T12:03:05Z
Published2026-05-12
Last modified2026-05-15

Underlying weaknesses· 1

CWE-459

References

  1. https://me.sap.com/notes/3733064
  2. https://url.sap/sapsecuritypatchday

1

TypeTargetConfidenceTier
WeaknessIncomplete Cleanupcwe-4590%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-27434
CVE
CVE-2026-27674
CVE
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
CVE
CVE-2026-2630
CVE
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability
CVE
CVE-2026-41003
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.