Advisory
SAP takes the security of its vast product portfolio very seriously and thus releases security fixes for
vulnerabilities reported by external researchers and their customers every second Tuesday of the month.
SAP Note 3800517
was released on
13.10.2026 and deals with
"3800517 - [CVE-2026-89113] SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)" within SAP Commerce Cloud.
We advice you to follow the instructions, to resolve
sql injection
with a
high potential for exploitation
in component CEC-SCC-PLA-PL.
According to SAP Security Advisory team a workaround exists. It is advisable to implement the correction as monthly patch process.
Risk specification
SAP Commerce Cloud allows an authenticated attacker to send specially crafted requests that inject arbitrary SQL commands, resulting in unauthorized reading, modification, and deletion of data in the application's database.
Solution
Certain input parameters are now validated and sanitized before being used to construct the search query.
Alternativly, the consulting team has proposed the following: "Disable the input parameter on the affected APIs. This eliminates the attack vector but also disables the associated 'sort' functionality for the affected endpoints. For detailed implementation instructions, please refer to FAQ Note 3803053.". The suggestion may
be considered, as a workaround or
compensating mitigation. We recommend installing/applying the correction wherever possible and as soon as possible. Base
your decision on whether or not to apply the patch on your companies and systems risk perspective and consider the
provided CVSS 8.8 score.
