CVE-2026-34263CWE-459

Missing authentication check in SAP Commerce cloud configuration

Critical · published May 12, 2026

CVSS v3.1
9.6
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00621 · 49.1th percentile
Weakness
CWE-459 · Incomplete Cleanup
Published
2026-05-12T02:20Z
EPSS history
Timeline
  • 12 MAY 02:20Z
    Missing authentication check in SAP Commerce cloud configuration
    cvelistv5