by Kastro
Paper/Archive/CVE-2026-44761

CVE-2026-44761

SAP_SE SAP Commerce Cloud — Insecure Sample Credentials in SAP Commerce Cloud

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 42.7.427 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.

Affected

ProductAffectedFixed inSource
SAP Commerce CloudHY_COM 2205–CNA
SAP Commerce CloudCOM_CLOUD 2211–CNA
SAP Commerce Cloud2211-JDK21–CNA

Scores by source

sap (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refme.sap.com/notes/3753495refurl.sap/sapsecuritypatchday