SAP SE Commerce Cloud vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting SAP SE Commerce Cloud: 5 record(s), with affected versions and fixes.cpe:2.3:a:sap:commerce_cloud
CVE-2026-44761
Critical · 9.1
CWE-1392 Jul 13, 2026
Insecure Sample Credentials in SAP Commerce Cloud
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.
CVE-2026-24321
Medium · 5.3
CWE-359 Feb 10, 2026
Information Disclosure vulnerability in SAP Commerce Cloud
SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.
CVE-2026-23684
Medium · 5.9
CWE-362 Feb 10, 2026
Race condition vulnerability in SAP Commerce Cloud
A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no impact on data confidentiality or availability of the application.
CVE-2025-42906
Medium · 5.3
CWE-22 Oct 13, 2025
Directory Traversal vulnerability in SAP Commerce Cloud
SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured access restrictions, resulting in a low impact on confidentiality, with no impact on the integrity or availability of the application.
CVE-2019-0344
Critical · 9.8
KEV High · 62 CWE-502 Aug 14, 2019
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.