CVE-2026-89113

8.8 HIGH

Published 2026-10-13 · Updated 2026-10-15

AI risk analysis

Summary: SAP Commerce Cloud fails to properly validate user input in database queries, allowing authenticated users to inject arbitrary SQL commands. This vulnerability can lead to unauthorized access to sensitive data and full database manipulation capabilities.
Exploitability: Exploitation requires an authenticated user account with access to affected functionality, making it moderately difficult to achieve but not highly complex.
Blast radius: If exploited, this vulnerability could result in widespread data breaches, allowing attackers to read, modify, or delete critical business data across the SAP Commerce platform.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: No fixed version is published. Disable the affected feature or restrict access to the named endpoint until a patch is available.

sql-injectiondatabasecommerceauthenticated

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.