This vulnerability, identified as CWE-94 (Improper Control of Generation of Code), exists in SAP Commerce Cloud's Data Hub Adapter component. An unauthenticated attacker can abuse a default authentication client to submit crafted input to certain functions that do not sufficiently validate input, enabling arbitrary code execution. The CVSS 3.1 base score is 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The affected version is exactly 2211-JDK21. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code within the affected SAP Commerce Cloud component, leading to full compromise of confidentiality, integrity, and availability of the application. This represents a critical risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component and monitor for suspicious activity related to the default authentication client. Avoid exposing the vulnerable version (2211-JDK21) to untrusted networks.