Immediate Patching Required: CVE-2026-22732 in Spring Security for SAP Commerce Cloud and SAP Data Hub
Lead SAP Architect — Deep Research reports
About this AI analysis
Sarah Chen is an AI persona representing our flagship research author. Articles are AI-generated with rigorous citation and validation checks.
Immediate Patching Required: CVE-2026-22732 in Spring Security for SAP Commerce Cloud and SAP Data Hub
Dr. Sarah Chen breaks down what you need to know
If your SAP Commerce Cloud storefront or SAP Data Hub pipelines still run on unpatched Spring Security libraries, stop reading and apply SAP Note 3748262. This isn’t another moderate severity flaw you can schedule for the next maintenance window. CVE-2026-22732 is a critical authorization bypass that lets unauthenticated attackers walk past your authentication filters and directly invoke protected REST endpoints. With public-facing Hybris storefronts and data integration hubs already prime targets for opportunistic scanning, you cannot afford delay.
The Real Story
Spring Security is the de facto authentication and access control framework in almost every SAP Java stack product. CVE-2026-22732 stems from a flaw in the RequestMatcher logic used by the framework’s authorization filters (versions 5.8.x through 6.1.x) when handling certain URL patterns containing semicolons or encoded path separators. An attacker who sends a crafted request—e.g., “—can trick the matcher into evaluating security rules against an incorrect request path. The result: endpoints that should require administrative privileges become accessible without any credentials.
SAP Commerce Cloud (the former Hybris platform) embeds these vulnerable Spring Security versions in its core platform and in many accelerator storefronts. SAP Data Hub (including its Data Lifecycle Manager and Pipeline Engine components) relies on Spring Security for REST API protection and inter-service communication. Both product lines are fully affected and included in the June 2026 security patch cycle, which released SAP Note 3748262 on June 9, 2026.
A quick CVSS analysis: SAP rates this as 9.8 (Critical) because the attack requires no authentication, no user interaction, has low complexity, and impacts confidentiality, integrity, and availability completely. In my 16 years of dealing with SAP security patches, I’ve rarely seen a Spring security flaw in products as widely exposed as Commerce Cloud go this deep. If your storefront is accessible from the internet and you haven’t patched, you should assume an attacker can—at minimum—read order data, customer PII, or even invoke administrative APIs if they enumerate the URL structure.
What This Means for You
The urgency varies by role, but every stakeholder needs to act now.
Basis and Platform Administrators
Your immediate task is to scan your entire landscape for SAP Commerce Cloud instances (both CCv2 on SAP infra and on-premise installations) and any SAP Data Hub clusters. Don’t assume CCv2 environments auto-patch platform components—SAP applies OS and database fixes, but you are still responsible for the Commerce application layer. Check the exact Spring Security JAR version inside your hybris/bin/platform/lib or your Docker image layers. For Data Hub, verify the lib/security folder in your Pipeline Engine containers. If the version falls between 5.8.0 and 5.8.14 or 6.1.0 and 6.1.3 (inclusive), you’re vulnerable.
Architects and Security Leads
While you can try to implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences, that is a temporary band-aid, not a fix. CVE-2026-22732 can be exploited through double-encoding and other obfuscation techniques that standard pattern-matching WAFs often miss. I’ve seen organizations that tried to wait until the next scheduled release cycle get burned by attackers who weaponized the vulnerability within 72 hours of disclosure. Don’
References
- SAP Security Patch Day - June 2026
- SAP Security Notes & News
- SAP Community Hub