SAP Commerce Cloud fails to properly validate certain user input before incorporating it into database queries. The flaw allows an authenticated attacker to send crafted requests that inject arbitrary SQL commands. The resulting misuse can read, modify, or delete sensitive data from the application’s database, compromising confidentiality, integrity, and availability of the platform.

The vulnerability affects SAP Commerce Cloud in its out‑of‑the‑box configuration. No specific product versions are listed, so all instances of the standard SAP Commerce Cloud distribution are potentially exposed.

The CVSS score of 8.8 indicates a high severity flaw. Although EPSS information is not available, the lack of a KEV listing does not diminish that an attacker with legitimate credentials can exploit the weakness. Because the attacker must be authenticated, the launch vector is likely via an authorized session within the internal network or through compromised user credentials. Successful exploitation could allow the attacker to read, alter, or destroy data, thereby posing a serious threat to the mission of the affected application.