# SAP May 2026 HotNews — CVE-2026-34263 Commerce Cloud Unauthenticated RCE & CVE-2026-34260 S/4HANA Enterprise Search SQL Injection (CVSS 9.6)

> SAP released its May 2026 Security Patch Day on May 12, 2026, addressing 15 security notes including two HotNews CRITICAL vulnerabilities both rated CVSS 9.6. CVE-2026-34263 is an unauthenticated remote code execution flaw in SAP Commerce Cloud caused by improper Spring Security configuration allowing configuration upload and code injection. CVE-2026-34260 is a SQL injection in SAP S/4HANA Enterprise Search for ABAP that allows an authenticated attacker to read sensitive data and disrupt availability. Both require immediate patching; no public PoC or active exploitation has been confirmed as of May 12, 2026.

- **Published:** 2026-05-12T12:00:00Z
- **Last reviewed:** 2026-05-12T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0501
- **ID:** TL-2026-0501
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-34263, CVE-2026-34260

## Description

SAP's May 2026 Security Patch Day, released on May 12, 2026, addressed 15 security notes across multiple enterprise SAP products, with two HotNews vulnerabilities both scoring CVSS 9.6 representing the most critical exposure.

CVE-2026-34263 — SAP Commerce Cloud Unauthenticated Remote Code Execution (SAP Note 3733064)

This critical flaw resides in SAP Commerce Cloud's Spring Security configuration. The root cause is an overly permissive security rule set with improper rule ordering — a classic Spring Security misconfiguration where more permissive rules are evaluated before restrictive ones, causing authentication checks to be bypassed entirely. An unauthenticated remote attacker can reach the misconfigured endpoint to upload malicious configuration files and inject arbitrary code, resulting in remote code execution (RCE) with the privileges of the Commerce Cloud process. Affected product lines include HY_COM 2205, COM_CLOUD 2211, and COM_CLOUD 2211-JDK21. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a network-accessible attack surface with low complexity, no authentication requirement, and full compromise of confidentiality, integrity, and availability with changed scope — meaning successful exploitation can affect components beyond the targeted SAP system, including connected ERP backends. The CWE-459 (Incomplete Cleanup) classification indicates that residual state from incomplete security enforcement leaves the authentication bypass exploitable.

SAP Commerce Cloud (formerly SAP Hybris) is a widely deployed enterprise e-commerce platform used by large retailers and B2B organizations globally. Successful exploitation of this RCE would allow attackers to fully compromise the application server, access customer PII and payment processing infrastructure, and pivot to connected SAP ERP systems via trusted internal network paths. The Hybris Administration Console (HAC) is the primary attack surface — its Groovy scripting engine and ImpEx import functionality are high-value targets once the authentication bypass is achieved.

CVE-2026-34260 — SAP S/4HANA Enterprise Search SQL Injection (SAP Note 3724838)

This flaw affects SAP S/4HANA's Enterprise Search for ABAP component across SAP_BASIS versions 751 through 758 and 816. The root cause is improper or missing input validation — user-controlled search input is directly concatenated into ABAP Open SQL queries without sanitization, creating a classic SQL injection vulnerability. An authenticated attacker with low-privilege access can inject malicious SQL statements through the Enterprise Search interface to manipulate database queries. Because the affected code path is read-only, integrity is not impacted; however, confidentiality and availability are rated high — meaning an attacker can exfiltrate sensitive ERP data spanning financial records, HR information, customer accounts, and business-critical master data, and cause denial-of-service conditions in the Enterprise Search component through resource-exhausting queries.

SAP S/4HANA is the core ERP platform for thousands of large enterprises. Enterprise Search is a cross-module search functionality, meaning the SQL injection surface potentially spans multiple sensitive business domains including FI (Finance), HR (HCM), SD (Sales and Distribution), and MM (Materials Management).

Context and Urgency

Both vulnerabilities were patched on SAP's standard monthly patch day with no evidence of active exploitation at time of disclosure. However, given the severity (CVSS 9.6), network-accessible attack vectors, and the historical pattern of threat actors targeting SAP systems — CISA has added 14+ SAP security flaws to its Known Exploited Vulnerabilities catalog in prior years, with ransomware actors specifically targeting unpatched SAP instances — rapid patching is essential. Onapsis Research Labs, a leading SAP security research firm, published independent analysis on May 12, 2026, confirming technical severity. Organizations unable to patch immediately should implement compensating controls including WAF rules targeting HAC endpoints, network segmentation isolating SAP Commerce Cloud from production ERP systems, and enhanced monitoring of SAP administration endpoints and ABAP query logs. The window between patch release and weaponization for SAP HotNews vulnerabilities has historically been days to weeks.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1212 Exploitation for Credential Access
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1071 Application Layer Protocol
- T1499 Endpoint Denial of Service

## Sources

- [SAP Security Patch Day — May 2026 (Official SAP Advisory)](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2026.html)
- [Onapsis Research Labs — SAP Security Patch Day May 2026 Analysis](https://onapsis.com/blog/sap-security-patch-day-may-2026/)
- [NVD — CVE-2026-34263 Detail (SAP Commerce Cloud RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-34263)
- [SAP Security Note 3733064 — CVE-2026-34263](https://me.sap.com/notes/3733064)
- [SAP Security Note 3724838 — CVE-2026-34260](https://me.sap.com/notes/3724838)
- [BleepingComputer — SAP Fixes Critical Vulnerabilities in Commerce Cloud and S/4HANA](https://www.bleepingcomputer.com/news/security/sap-fixes-critical-vulnerabilities-in-commerce-cloud-and-s-4hana/)
- [SecurityWeek — SAP Patches Critical S/4HANA, Commerce Vulnerabilities](https://www.securityweek.com/sap-patches-critical-s-4hana-commerce-vulnerabilities/)
- [TheHackerWire — SAP Commerce Cloud RCE via Spring Security Misconfiguration](https://www.thehackerwire.com/sap-commerce-cloud-rce-via-spring-security-misconfiguration/)
- [TheHackerWire — SAP S/4HANA SQL Injection CVE-2026-34260](https://www.thehackerwire.com/sap-s-4hana-sql-injection-cve-2026-34260/)
- [CyberPress — SAP Patches Critical SQL Injection Flaw in SAP S/4HANA](https://cyberpress.org/sap-patches-in-sap-s-4hana/)
- [CIRCL Vulnerability Lookup — CVE-2026-34263](https://vulnerability.circl.lu/vuln/cve-2026-34263)
- [CIRCL Vulnerability Lookup — CVE-2026-34260](https://vulnerability.circl.lu/vuln/cve-2026-34260)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0501