What is the CVSS score of CVE-2026-34263?

CVE-2026-34263 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of SAP Commerce Cloud are affected by CVE-2026-34263?

SAP Commerce Cloud is vulnerable to unauthenticated arbitrary code execution through malicious configuration file uploads, allowing attackers to compromise confidentiality, integrity, and…

How to fix or mitigate CVE-2026-34263?

Within 24 hours: Identify all SAP Commerce Cloud instances in production and development environments; consult SAP Security Note 3733064 for interim hardening guidance. Within 7 days: Implement network segmentation to restrict configuration upload endpoints to trusted internal sources only; enforce multi-factor authentication on all administrative access; disable Spring Security auto-configuration if operationally feasible pending patch release. Within 30 days: Monitor SAP vendor advisories for patch availability; conduct security assessment of configuration file handling; establish audit logging on all configuration uploads and code injection attempts.

SAP Commerce Cloud CVE-2026-34263

EUVD-2026-29372 CRITICAL

Incomplete Cleanup (CWE-459)

2026-05-12 sap

GHSA-wxxf-gjw8-32x8

RCE Java SAP

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 03:16 vuln.today

CVE Published

May 12, 2026 - 02:20 nvd

CRITICAL 9.6

DescriptionCVE.org

Due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

AnalysisAI

Arbitrary server-side code execution in SAP Commerce Cloud via unauthenticated malicious configuration upload and code injection. Attackers can remotely exploit a misconfigured Spring Security framework to upload crafted configuration files and inject code without authentication, requiring only that a user interact with malicious content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). The vulnerability affects SAP Commerce Cloud Configuration with critical impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing identified at time of analysis, though EPSS data unavailable. Patch details available in SAP Security Note 3733064.

Technical ContextAI

SAP Commerce Cloud is an enterprise e-commerce platform built on Java and Spring Framework. This vulnerability stems from CWE-459 (Incomplete Cleanup), manifesting as improper Spring Security configuration that fails to enforce authentication controls on configuration upload endpoints. Spring Security is the de-facto authentication and authorization framework for Java applications, and misconfigurations can expose administrative functions to unauthorized access. The affected component (cpe:2.3:a:sap_se:sap_commerce_cloud_configuration) specifically handles configuration management operations. When Spring Security is improperly configured, it may allow unauthenticated HTTP requests to bypass security filters, enabling attackers to upload malicious configuration files that the application processes without validation, leading to code injection and arbitrary execution within the application server context.

RemediationAI

Apply the vendor-released security patch detailed in SAP Security Note 3733064, accessible at https://me.sap/notes/3733064 (requires SAP Support Portal credentials). Refer to SAP Security Patch Day advisory at https://url.sap/sapsecuritypatchday for complete patch deployment guidance and version-specific instructions. If immediate patching is not feasible, implement compensating controls: restrict network access to SAP Commerce Cloud configuration endpoints to trusted IP ranges only via firewall rules or web application firewall (WAF) policies; disable or restrict configuration upload functionality if not operationally required (note: may impact administrative workflows); implement additional authentication layers such as mutual TLS or VPN access for configuration management interfaces; enable comprehensive logging and monitoring for configuration upload attempts from unexpected sources. These workarounds reduce attack surface but do not eliminate the underlying Spring Security misconfiguration - patching remains the definitive remediation.