SAP Issues 15 May Security Notes With Two 9.6 CVEs: a Read-Only SQL Injection in S/4HANA Enterprise Search and an Unauthenticated Commerce Cloud Bypass
SAP's May 12 Patch Day fixes CVE-2026-34260 in S/4HANA's Enterprise Search for ABAP and CVE-2026-34263 in Commerce Cloud, plus a high-severity OS command injection in Forecasting & Replenishment.
Overview
SAP released 15 security notes on May 12 as part of its May 2026 Security Patch Day, with two of the fixes carrying CVSS scores of 9.6, according to SecurityWeek. The first critical bug, CVE-2026-34260, is an SQL injection flaw in S/4HANA’s Enterprise Search component; the second, CVE-2026-34263, is a missing-authentication issue in SAP Commerce Cloud. A third high-severity OS command injection in Forecasting & Replenishment rounds out the priority fixes.
What We Know
The S/4HANA bug is delivered via SAP HotNews Note 3724838 and is described by SAP as “an SQL injection issue stemming from missing input validation and sanitization,” SecurityWeek reported. CSO Online identifies the affected component as Enterprise Search for ABAP and notes that exploitation requires an authenticated attacker who can supply malicious SQL through user-controlled input. Layer Seven Security lists the affected releases as SAP_BASIS 7.51 through 7.58 and 8.16.
The impact is narrower than the headline CVSS score suggests. Onapsis, the security firm whose researchers analyzed the note, told CSO Online that “the affected source code only allows read access to data, so that integrity is not impacted,” per CSO Online’s roundup. Jonathan Stross, SAP security analyst at Pathlock, framed the bug as the standout of the month for affected customers, calling it “the most important technical vulnerability of the month” for organizations running Enterprise Search for ABAP, also via CSO Online.
The Commerce Cloud flaw, CVE-2026-34263, is delivered through SAP Security Note 3733064 and is described by SecurityWeek as “a missing authentication check affecting the cloud configuration.” Layer Seven Security attributes the root cause to an improper Spring Security configuration with overly permissive access rules, and says an unauthenticated attacker can upload a malicious configuration and inject code. Fixed builds are listed as Commerce Cloud 2205.49, 2211.51, and 2211-jdk21.10.
The high-priority third entry, CVE-2026-34259, is an OS command injection in SAP Forecasting & Replenishment delivered via Security Note 3732471. SecurityWeek says the flaw could allow authenticated attackers to execute arbitrary operating system commands, and Layer Seven Security clarifies that exploitation requires administrative authorizations to abuse a non-remote-enabled function.
CSO Online breaks the 15 notes down as two HotNews Notes, two High Priority Notes, and 12 Medium Priority Notes. The remaining 12 medium and low-severity fixes touch NetWeaver, S/4HANA, Business Server Pages Application, BusinessObjects, Strategic Enterprise Management, Commerce Cloud, SAPUI5, Financial Consolidation, Incentive and Commission Management, and the HANA Deployment Infrastructure, SecurityWeek reported.
Cybersecurity News and GBHackers, reporting on the same disclosures, both confirm CVE-2026-34260’s 9.6 CVSS rating and the Enterprise Search for ABAP component.
What We Don’t Know
None of the sources cited above report active exploitation in the wild for any of the three priority CVEs as of disclosure. The number of customer tenants running affected Enterprise Search for ABAP configurations is not disclosed, nor is the share of Commerce Cloud customers still on builds prior to 2205.49, 2211.51, or 2211-jdk21.10. SAP has not publicly named the original reporters of the three priority CVEs; Onapsis and Pathlock provided post-release commentary on the bugs rather than authoring the SAP notes themselves, based on the cited reports.
Analysis
The May notes are unusual for SAP in that two HotNews-rated bugs landed in a single patch day with identical CVSS scores but very different exploitation profiles. CVE-2026-34260 requires authenticated access and, per Onapsis’s analysis as relayed by CSO Online, only allows read access to data — a meaningful constraint that pulls the practical risk below what the 9.6 score implies, especially for tenants that do not run the Enterprise Search for ABAP module. CVE-2026-34263 is the more straightforwardly dangerous of the two: unauthenticated, network-reachable, and capable of code execution via configuration upload, per Layer Seven Security’s writeup.
For SAP shops, the practical sequencing is therefore inverted relative to the headlines. Commerce Cloud customers who have not yet rolled to 2205.49, 2211.51, or 2211-jdk21.10 face an internet-exposed unauthenticated bug; S/4HANA customers running Enterprise Search for ABAP face a high-severity but authenticated read-only issue. The OS command injection in Forecasting & Replenishment is gated behind administrative authorizations and is a smaller blast radius.