Answer in brief
CVE-2026-89113 records a High severity (CVSS 8.8) vulnerability in SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code). The current sources do not mark it as known exploited. The current feed maps SAP_SE/SAP Commerce Cloud (OOTB Code) (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps SAP_SE/SAP Commerce Cloud (OOTB Code) (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| SAP_SE/SAP Commerce Cloud (OOTB Code)generic | COM_CLOUD 2211-JDK21 | Not reported |
Published upstream
Oct 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 13, 2026
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.
Quoted source text, attributed separately from HOL analysis.