CVE-2026-89113— SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)
Quick assessment
Affected
SAP_SE SAP Commerce Cloud (OOTB Code)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Commerce Cloud 在将某些用户提供的输入嵌入数据库查询之前，未对其进行充分验证。经过身份验证的攻击者可以通过向受影响的功能发送精心构造的请求，注入任意 SQL 命令。成功利用该漏洞后，攻击者可以读取、修改或删除应用程序数据库中存储的敏感数据，从而对应用程序的机密性、完整性和可用性造成高影响。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP Commerce Cloud (OOTB Code) | COM_CLOUD 2211-JDK21 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89113
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)
Source: CVE Program / CVE List V5
Vulnerability Description
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Commerce Cloud (OOTB Code) | COM_CLOUD 2211-JDK21 | - |
|
II. Public POCs for CVE-2026-89113
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89113
请登录查看更多情报信息。
Other References for CVE-2026-89113 (1)
Same Patch Batch · SAP_SE · 2026-10-13 · 20 CVEs total
| CVE-2026-89111 | 10.0 CRITICAL | OAuth2 SSRF vulnerability in SAP Cloud SDK for Python |
| CVE-2026-89107 | 9.9 CRITICAL | Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) |
| CVE-2026-89110 | 9.9 CRITICAL | Broken Access Control in SAP NetWeaver Visual Composer |
| CVE-2026-89108 | 9.1 CRITICAL | Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configurati |
| CVE-2026-58249 | 7.5 HIGH | Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communic |
| CVE-2026-89120 | 7.1 HIGH | Missing authorization check in SAP ABAP Platform |
| CVE-2026-89112 | 6.5 MEDIUM | Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure |
| CVE-2026-76972 | 6.5 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence |
| CVE-2026-89122 | 6.1 MEDIUM | Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89117 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-76975 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) |
| CVE-2026-89116 | 5.9 MEDIUM | OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code |
| CVE-2026-76976 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applica |
| CVE-2026-89118 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89121 | 4.7 MEDIUM | Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) |
| CVE-2026-89106 | 4.4 MEDIUM | Cross Site Scripting (XSS) vulnerability in SAPUI5 |
| CVE-2026-89124 | 4.3 MEDIUM | Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Pr |
| CVE-2026-89105 | 4.2 MEDIUM | Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integra |
| CVE-2026-58242 | 3.5 LOW | Improper Authorization check in SAP Cloud Connector |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-89124
Missing Authorization Check in SAP Global Trade Services, ed -
CVE-2026-89122
Open Redirect Vulnerability in SAP NetWeaver Enterprise Port -
CVE-2026-89121
Missing Authorization Check in SAP S/4HANA (Linear Asset Man -
CVE-2026-89120
Missing authorization check in SAP ABAP Platform -
CVE-2026-89118
Information Disclosure vulnerability in SAP NetWeaver Enterp
Same weakness: CWE-89
V. Comments for CVE-2026-89113
No comments yet