CVE-2021-27602

CVE-2021-27602 is a critical remote code execution (RCE) vulnerability affecting SAP Commerce versions 1808, 1811, 1905, 2005, and 2011. An authenticated attacker with specific authorization can inject malicious code into source rules within the Backoffice application, leading to RCE when these rules are published. This vulnerability carries a CVSS score of 9.9 (CRITICAL) due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness of its severity. The EPSS score is low, suggesting a low probability of exploitation in the wild despite its critical nature.