What’s Vulnerable › Vulnerabilities
CVE-2026-24321: Information Disclosure vulnerability in SAP Commerce Cloud
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-10 · updated 2026-06-17
- Weakness: CWE-359
Description
SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.
Affected products
- SAP_SE SAP Commerce Cloud: 2205, 2211
References
Get alerted when CVE-2026-24321 or the next vulnerability affects your stack