Unauthenticated code execution flaw in SAP Commerce Cloud (Data Hub Adapter)

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

• SAP_SE SAP Commerce Cloud (Data Hub Adapter) has a default status of unaffected in the record.
• COM_CLOUD 2211 is identified as affected.
• 2211-JDK21 is identified as affected.
• The record does not provide a fixed version or broader version boundaries. Other branches should not be assumed safe solely because they are not listed.

The flaw affects SAP Commerce Cloud Data Hub Adapter. An unauthenticated attacker can abuse a default authentication client and submit specially crafted input to certain functions that do not perform sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components. The record classifies the weakness as CWE-94, Improper Control of Generation of Code. The record does not identify the specific functions, endpoints, payload format, processing path, or code execution context, so those details should not be inferred.

• The vulnerability is network reachable and does not require authentication according to the supplied assessment data.
• Exploitation is assessed as low complexity and does not require user interaction.
• The supplied record sets public_exploit to false and does not identify a known_exploited status. The CISA ADP data shown with the record reports exploitation as none at the time of that assessment; this does not establish that exploitation is currently absent.
• The record provides no public exploit code, exploit sequence, endpoint-specific details, or confirmed indicators of compromise.

Exploitation could result in arbitrary code execution through the application and compromise of internal components. Technical consequences may include reading or modifying data, using the privileges of the application process, and reducing service availability. The supplied assessment indicates that impact may cross the boundary of the initially affected component, but the record does not describe the specific operating-system privileges, service account, or connected systems that would be affected. The record contains no evidence of a confirmed compromise.

• An unauthenticated attacker could obtain arbitrary code execution in the application context if the exploitation conditions are met.
• Compromise of internal components could expose data, permit data modification, or disrupt service availability.
• Because the assessment indicates that impact can extend beyond the initially vulnerable component, connected systems or related resources could also be affected; this is a possible consequence, not a confirmed incident.
• The record does not confirm a breach, data disclosure, or service outage.

1. Identify every SAP Commerce Cloud deployment that includes Data Hub Adapter on COM_CLOUD 2211 or 2211-JDK21.
2. Review SAP Security Note 3771065 and the SAP Security Patch Day correction to determine the applicable SAP update, then deploy it according to SAP's instructions. The supplied record contains no solution text or exact fixed release.
3. After updating, verify the installed branch and Data Hub Adapter status on each system, and confirm that the default authentication client no longer provides unintended external access.
4. If an update cannot be applied immediately, restrict untrusted network access to the affected component and increase monitoring for unauthenticated requests. This is a precautionary measure only; the record does not confirm a specific compensating mitigation.

1. Inventory SAP Commerce Cloud deployments that include Data Hub Adapter, then compare each deployment's branch and status with the affected scope.
2. Check whether the default authentication client remains enabled and reachable from untrusted networks. Do not infer a configuration key or endpoint name because the record does not provide one.
3. Review Data Hub Adapter access and application logs for unusual unauthenticated requests, rejected crafted input, or unexpected execution behavior. This is precautionary monitoring, not a confirmed indicator of compromise.
4. Review change records to confirm that SAP's correction was deployed to the correct product branch. The absence of suspicious log events does not prove that a deployment is safe.