SAP Commerce Cloud SQL Injection via Unvalidated Input
CVE-2026-89113 Published on October 13, 2026
SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.
Vulnerability Analysis
CVE-2026-89113 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a SQL Injection Vulnerability?
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CVE-2026-89113 has been classified to as a SQL Injection vulnerability or weakness.
Products Associated with CVE-2026-89113
Want to know whenever a new CVE is published for SAP Commerce Cloud? stack.watch will email you.
