{"id":"CVE-2026-89113","published":"2026-10-13T01:16:48.153","lastModified":"2026-10-15T20:38:04.303","description":"SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3800517","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SAP Commerce Cloud fails to properly validate user input in database queries, allowing authenticated users to inject arbitrary SQL commands. This vulnerability can lead to unauthorized access to sensitive data and full database manipulation capabilities.","exploitability":"Exploitation requires an authenticated user account with access to affected functionality, making it moderately difficult to achieve but not highly complex.","blast_radius":"If exploited, this vulnerability could result in widespread data breaches, allowing attackers to read, modify, or delete critical business data across the SAP Commerce platform.","remediation":"No fixed version is published. Disable the affected feature or restrict access to the named endpoint until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","database","commerce","authenticated"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:03:08.150Z"}}