High priorityDisclosed

Advisory · CVE-2026-89113

SQL injection in SAP Commerce Cloud

SAP Commerce Cloud does not sufficiently validate user input before it reaches a database query, letting an authenticated user inject arbitrary SQL and read, modify, or delete sensitive data. SAP rates it CVSS 3.1 8.8.

Advisory published October 13, 2026Independent summary
Vendor
SAP
Product
Commerce Cloud
Identifier / CWE
CVE-2026-89113
CWE-89
Action timing
Immediate
ELI5

Explain it like I’m five

Commerce Cloud stitches user input into database queries, so a signed-in user can rewrite the query and talk straight to the store's database.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Sign in

    An authenticated attacker reaches the affected Commerce Cloud functionality.

  2. 02Injected input

    The attacker sends specially crafted input that is incorporated into a database query without sufficient validation.

  3. 03Database access

    The injected SQL lets the attacker read, modify, or delete sensitive data in the application database.

What happened

SAP disclosed CVE-2026-89113 for Commerce Cloud (OOTB Code), affecting COM_CLOUD 2211-JDK21. User-supplied input is not sufficiently validated before being incorporated into a database query (CWE-89), and an authenticated user can inject arbitrary SQL commands. SAP says the result can be read, modify, or delete access to sensitive database data.

Apply SAP note 3800517 through the normal SAP patch process; this advisory does not name a fixed version beyond the note.

What to do

  1. Inventory every Commerce Cloud deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Commerce Cloud while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for database errors and injection-style input in Commerce Cloud request logs, plus unexpected reads of customer or order tables.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Commerce databases hold customer and payment-adjacent data. Treat this as a data exposure investigation alongside the patch.