CVE-2026-89113 · CVSS 3.0 8.8 · SAP Note 3800517
The database behind Commerce Cloud changes the consequences of CVE-2026-89113. SAP says information disclosure is possible across supported database engines, while modification and deletion depend on an engine that permits multi-statement execution, such as Microsoft SQL Server. The vulnerability is in SAP’s out-of-the-box code.
An authenticated API path
Note 3800517 carries CVSS 8.8 and High priority. An affected list API incorporates insufficiently checked request input into a query. An attacker needs a valid authenticated session for that API; no other user interaction is required. SAP’s terms include couponwebservices and paginated search. Review the affected API use alongside the database platform rather than assuming that every deployment has identical impact.
Apply, rebuild and redeploy
The affected component branch is COM_CLOUD 2211-JDK21. SAP identifies 2211-jdk21.18 as the release containing the fix and permits a later available patch. The correction validates and sanitizes the relevant input before query construction. Updating a downloaded package alone does not finish the job: SAP requires customers to rebuild and redeploy the updated Commerce Cloud version.
The workaround removes sorting functionality
SAP documents a temporary approach that disables the affected input parameter on the impacted APIs. It removes the attack path at the cost of the associated sorting functionality. Detailed implementation is in FAQ 3803053. Confirm client dependencies before adopting that restriction.
Verify the deployed build
Record the live build version after deployment and exercise the relevant authenticated list APIs with ordinary pagination and sort requests. If an interim restriction was used, confirm the intended behavior when moving to the permanent correction. Database audit review can support investigation of suspicious access, but the advisory alone does not establish that any customer data has been accessed.
Advisory details
Component: CEC-SCC-PLA-PL
SAP priority: Correction with high priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: SAP Security Note 3800517 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
