Loading vulnerability…
Authenticated SQL Injection in SAP Commerce Cloud
CVE-2026-89113 is an SQL injection vulnerability in SAP Commerce Cloud caused by insufficient validation of user-supplied input before incorporation into database queries. A low-privileged authenticated attacker can submit specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation can expose, modify, or delete sensitive application database data. The vulnerability has a CVSS v3.1 score of 8.8, with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Specific affected versions, endpoints, and vulnerable functions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of sensitive application database information through unauthorized reads, modifications, and deletions. Destructive database operations can also compromise application availability. Potential confidentiality, integrity, and availability impacts are rated high.
If you can’t patch tonight, do this now.
No vendor-provided workaround is identified. Pending remediation, restrict access to affected functionality to trusted users and enforce least-privilege permissions for the application's database account. These interim measures may reduce exposure or impact but do not eliminate the SQL injection vulnerability.
Patch, then assume compromise.
Consult SAP Security Note 3800517 and SAP's October 13, 2026 security bulletin to identify and apply the applicable SAP Commerce Cloud security correction. Specific affected versions, fixed releases, and installation instructions are not available in the supplied information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.