SAP May 2026 HotNews — CVE-2026-34263 Commerce Cloud Unauthenticated RCE & CVE-2026-34260 S/4HANA Enterprise Search SQL Injection (CVSS 9.6)

SAP May 2026 HotNews (TL-2026-0501) is a critical-severity software vulnerability scored CVSS 9.6, first published 2026-05-12. It has no confirmed attribution, affects SAP SE SAP Commerce Cloud, references 2 CVEs (CVE-2026-34263, CVE-2026-34260), maps to 13 MITRE ATT&CK techniques (T1005, T1041, T1046), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0501

Threat ID
TL-2026-0501
Severity
CRITICAL
CVSS
9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-05-12
Last reviewed
2026-05-12
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
retail, e-commerce, financial, manufacturing, healthcare, energy, government, professional-services, automotive, consumer-goods
Target regions
Global, North America, Europe, Asia Pacific, Middle East
Detection rules
9
Indicators of compromise
15

Malware and tooling in SAP May 2026 HotNews

Malware and tooling: SAP Hybris Administration Console (HAC) — externally exposed or unauthenticated access

SAP released its May 2026 Security Patch Day on May 12, 2026, addressing 15 security notes including two HotNews CRITICAL vulnerabilities both rated CVSS 9.6. CVE-2026-34263 is an unauthenticated remote code execution flaw in SAP Commerce Cloud caused by improper Spring Security configuration allowing configuration upload and code injection. CVE-2026-34260 is a SQL injection in SAP S/4HANA Enterprise Search for ABAP that allows an authenticated attacker to read sensitive data and disrupt availability. Both require immediate patching; no public PoC or active exploitation has been confirmed as of May 12, 2026.

How SAP May 2026 HotNews works

SAP's May 2026 Security Patch Day, released on May 12, 2026, addressed 15 security notes across multiple enterprise SAP products, with two HotNews vulnerabilities both scoring CVSS 9.6 representing the most critical exposure.

CVE-2026-34263 — SAP Commerce Cloud Unauthenticated Remote Code Execution (SAP Note 3733064)

This critical flaw resides in SAP Commerce Cloud's Spring Security configuration. The root cause is an overly permissive security rule set with improper rule ordering — a classic Spring Security misconfiguration where more permissive rules are evaluated before restrictive ones, causing authentication checks to be bypassed entirely. An unauthenticated remote attacker can reach the misconfigured endpoint to upload malicious configuration files and inject arbitrary code, resulting in remote code execution (RCE) with the privileges of the Commerce Cloud process. Affected product lines include HY_COM 2205, COM_CLOUD 2211, and COM_CLOUD 2211-JDK21. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a network-accessible attack surface with low complexity, no authentication requirement, and full compromise of confidentiality, integrity, and availability with changed scope — meaning successful exploitation can affect components beyond the targeted SAP system, including connected ERP backends. The CWE-459 (Incomplete Cleanup) classification indicates that residual state from incomplete security enforcement leaves the authentication bypass exploitable.

SAP Commerce Cloud (formerly SAP Hybris) is a widely deployed enterprise e-commerce platform used by large retailers and B2B organizations globally. Successful exploitation of this RCE would allow attackers to fully compromise the application server, access customer PII and payment processing infrastructure, and pivot to connected SAP ERP systems via trusted internal network paths. The Hybris Administration Console (HAC) is the primary attack surface — its Groovy scripting engine and ImpEx import functionality are high-value targets once the authentication bypass is achieved.

CVE-2026-34260 — SAP S/4HANA Enterprise Search SQL Injection (SAP Note 3724838)

This flaw affects SAP S/4HANA's Enterprise Search for ABAP component across SAP_BASIS versions 751 through 758 and 816. The root cause is improper or missing input validation — user-controlled search input is directly concatenated into ABAP Open SQL queries without sanitization, creating a classic SQL injection vulnerability. An authenticated attacker with low-privilege access can inject malicious SQL statements through the Enterprise Search interface to manipulate database queries. Because the affected code path is read-only, integrity is not impacted; however, confidentiality and availability are rated high — meaning an attacker can exfiltrate sensitive ERP data spanning financial records, HR information, customer accounts, and business-critical master data, and cause denial-of-service conditions in the Enterprise Search component through resource-exhausting queries.

SAP S/4HANA is the core ERP platform for thousands of large enterprises. Enterprise Search is a cross-module search functionality, meaning the SQL injection surface potentially spans multiple sensitive business domains including FI (Finance), HR (HCM), SD (Sales and Distribution), and MM (Materials Management).

Context and Urgency

Both vulnerabilities were patched on SAP's standard monthly patch day with no evidence of active exploitation at time of disclosure. However, given the severity (CVSS 9.6), network-accessible attack vectors, and the historical pattern of threat actors targeting SAP systems — CISA has added 14+ SAP security flaws to its Known Exploited Vulnerabilities catalog in prior years, with ransomware actors specifically targeting unpatched SAP instances — rapid patching is essential. Onapsis Research Labs, a leading SAP security research firm, published independent analysis on May 12, 2026, confirming technical severity. Organizations unable to patch immediately should implement compensating controls including WAF rules targeting HAC endpoints, network segmentation isolating SAP Commerce Cloud from production ERP systems, and enhanced monitoring of SAP administration endpoints and ABAP query logs. The window between patch release and weaponization for SAP HotNews vulnerabilities has historically been days to weeks.

MITRE ATT&CK techniques used in TL-2026-0501

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application

Defense Evasion

T1211 Exploitation for Stealth

Credential Access

T1212 Exploitation for Credential Access

Impact

T1499 Endpoint Denial of Service

Persistence

T1505 Server Software Component

Affected products and versions in SAP May 2026 HotNews

  • SAP SE — SAP Commerce Cloud
    Vulnerable versions: HY_COM 2205; COM_CLOUD 2211; COM_CLOUD 2211-JDK21
    Fixed in: Apply SAP Note 3733064 to all affected versions
  • SAP SE — SAP S/4HANA
    Vulnerable versions: SAP_BASIS 751; SAP_BASIS 752; SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758; SAP_BASIS 816
    Fixed in: Apply SAP Note 3724838 to all affected SAP_BASIS versions
  • SAP SE — SAP Forecasting and Replenishment
    Vulnerable versions: See SAP Note 3732471 for affected versions
    Fixed in: Apply SAP Note 3732471

Remediation for SAP May 2026 HotNews

Patches

  • SAP Security Note 3733064 — CVE-2026-34263 — SAP Commerce Cloud (HY_COM 2205, COM_CLOUD 2211, COM_CLOUD 2211-JDK21)
  • SAP Security Note 3724838 — CVE-2026-34260 — SAP S/4HANA SAP_BASIS 751, 752, 753, 754, 755, 756, 757, 758, 816
  • SAP Security Note 3732471 — CVE-2026-34259 — SAP Forecasting and Replenishment OS Command Injection (CVSS 8.2 — companion HotNews same patch day)
  • SAP Security Note 3721959 — CVE-2026-40132 — SAP Strategic Enterprise Management Missing Authorization Check (CVSS 5.4)
  • SAP Security Note 3728690 — CVE-2026-27682 — SAP NetWeaver Application Server ABAP Reflected XSS (CVSS 4.7)

Immediate actions

  • Apply SAP Security Note 3733064 for CVE-2026-34263 (SAP Commerce Cloud — HY_COM 2205, COM_CLOUD 2211, COM_CLOUD 2211-JDK21)
  • Apply SAP Security Note 3724838 for CVE-2026-34260 (SAP S/4HANA Enterprise Search — SAP_BASIS 751-758, 816)
  • Restrict network access to SAP Commerce Cloud HAC (Hybris Administration Console) to trusted admin IPs only via firewall or WAF
  • Disable or block the SAP Commerce Cloud configuration upload and ImpEx import endpoints from external/untrusted network sources until patch is applied
  • Review Spring Security configuration files in SAP Commerce Cloud for overly permissive rule ordering (permitAll before requiresAuthentication patterns)
  • Enable SAP Commerce Cloud audit logging for HAC access, configuration uploads, and scripting engine execution events
  • Monitor SAP S/4HANA Enterprise Search for anomalous query patterns: SQL metacharacters, excessively long inputs, UNION SELECT patterns, and comment sequences in search parameters
  • Enable SAP SM20 audit log and DB02 database monitoring for anomalous ABAP Open SQL execution volumes from Enterprise Search function modules

Workarounds

  • CVE-2026-34263: Block all external access to SAP Commerce Cloud HAC at the network perimeter; restrict /hac/* endpoints to known admin IP ranges via ACL or WAF rules
  • CVE-2026-34263: Disable Groovy scripting engine in SAP Commerce HAC if not required for operations; restrict ImpEx import functionality to authenticated sessions only
  • CVE-2026-34260: Restrict SAP S/4HANA Enterprise Search access to authorized users with documented business need; validate and strip SQL metacharacters at the application gateway
  • CVE-2026-34260: Enable SAP audit log (SM20) and alert on anomalous ABAP database calls from Enterprise Search RFC function modules exceeding baseline thresholds
  • Deploy reverse proxy in front of SAP Commerce Cloud to strip or block HTTP requests to configuration management endpoints from non-admin source addresses

Longer-term hardening

  • Subscribe to SAP Security Notes RSS feed and implement a 24-hour SLA for HotNews patch evaluation and a 72-hour SLA for patch application
  • Deploy WAF with SAP-aware rulesets to inspect and block malicious configuration upload attempts targeting HAC endpoints
  • Implement SAP Enterprise Threat Detection (ETD) or equivalent SIEM integration for real-time SAP security event monitoring
  • Conduct regular SAP security configuration audits focusing on Spring Security rule ordering and ABAP input validation across all custom code
  • Network-segment SAP Commerce Cloud from production ERP environments to limit lateral movement impact if Commerce Cloud is compromised
  • Establish SAP-specific vulnerability management process with a mandatory 72-hour patch window for CVSS 9.0+ HotNews security notes
  • Deploy Onapsis or equivalent SAP vulnerability scanner to continuously assess patch compliance across all SAP instances

CVEs associated with SAP May 2026 HotNews

CVE-2026-34263, CVE-2026-34260

Weaknesses (CWE) in SAP May 2026 HotNews

CWE-459, CWE-89

Timeline of SAP May 2026 HotNews

  • NVD received CVE-2026-34263 from SAP SE on May 11, 2026; vulnerability record created and marked awaiting NVD enrichment with CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
  • Threadlinqs Intelligence published defensive threat record TL-2026-0501 with full MITRE ATT&CK mapping across 10 tactics, 15 defensive IOCs, complete remediation guidance, and detection coverage for both SAP May 2026 HotNews CVEs
  • CVE-2026-34263 and CVE-2026-34260 not listed in CISA Known Exploited Vulnerabilities (KEV) catalog as of May 12, 2026; no confirmed in-the-wild exploitation or public proof-of-concept exploit code observed at time of research
  • BleepingComputer, SecurityWeek, TheHackerWire, and CyberPress published coverage amplifying awareness of both CVSS 9.6 SAP HotNews vulnerabilities; no active exploitation or PoC reported in any source
  • Onapsis Research Labs published independent technical analysis of both HotNews vulnerabilities on patch day, confirming the Spring Security misconfiguration root cause for CVE-2026-34263 and SQL injection mechanism for CVE-2026-34260, and providing technical severity assessment for defenders
  • SAP released May 2026 Security Patch Day with 15 security notes including two HotNews: SAP Note 3733064 (CVE-2026-34263, CVSS 9.6 — SAP Commerce Cloud unauthenticated RCE) and SAP Note 3724838 (CVE-2026-34260, CVSS 9.6 — SAP S/4HANA Enterprise Search SQL injection)
  • As of 2026-05-29, both CVSS 9.6 SAP HotNews flaws (CVE-2026-34263, CVE-2026-34260) remain patched (SAP Notes 3733064/3724838, May 12) with no public PoC, no confirmed in-the-wild exploitation, and neither in CISA KEV. They stay a live concern given the no-workaround unauth RCE and SAP's days-to-weeks weaponization history, so unpatched estates warrant active monitoring.

Sources cited for SAP May 2026 HotNews

More in vulnerability

Detection coverage for TL-2026-0501

As of 2026-05-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0501 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats