SAP Commerce Cloud (Data Hub Adapter) allows unauthenticated attackers to abuse a default authentication client and pass crafted input to functions missing validation, leading to code injection (CWE-94) and potential arbitrary code execution impacting internal components. Affected: COM_CLOUD 2211 and 2211-JDK21. Apply SAP Note 3771065 / SAP Security Patch Day fixes.