EUVD-2026-55999
GHSA-686g-q5w6-7j38
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable default auth client (PR:N/AV:N/AC:L), no interaction (UI:N), code execution pivoting to internal components justifies S:C and C:H/I:H/A:H.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.
Articles & Coverage 2
AnalysisAI
Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the SAP Commerce Cloud Data Hub Adapter and the presence of the default authentication client, which the description states an unauthenticated attacker can abuse - meaning a deployment left with that default client enabled is exploitable without credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Every CVSS signal points to maximum real-world risk: AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), and S:C (scope change) with C:H/I:H/A:H combine to the ceiling score of 10.0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix from SAP Security Note 3771065 (https://me.sap.com/notes/3771065), released under SAP Security Patch Day (https://url.sap/sapsecuritypatchday); the input does not include an exact fixed version number, so the specific patch level must be read from that note rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all SAP Commerce Cloud instances running Data Hub Adapter and isolate them from production networks using air-gapping or strict network segmentation; disable the default authentication client if operationally feasible; enable comprehensive logging and alerting on inbound traffic to the Data Hub Adapter. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today