CVE-2026-89113: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in SAP_SE SAP Commerce Cloud (OOTB Code)

SAP Commerce Cloud (OOTB Code) does not properly neutralize special elements in user input used within SQL commands, leading to an SQL injection vulnerability (CWE-89). Authenticated users can exploit this by crafting requests that inject arbitrary SQL commands into the database query execution. This vulnerability allows attackers to read, modify, or delete sensitive data in the application's database, posing a high risk to data confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure, modification, or deletion of sensitive data stored by the application. The impact affects the confidentiality, integrity, and availability of the SAP Commerce Cloud application data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, it is recommended to monitor SAP's official advisories for updates. In the meantime, restrict authenticated user privileges to the minimum necessary and review application logs for suspicious activity related to database queries.