What’s Vulnerable › Vulnerabilities
CVE-2026-44761: Insecure Sample Credentials in SAP Commerce Cloud
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-14 · updated 2026-10-24
- Weakness: CWE-1392
Description
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.
Affected products
- SAP_SE SAP Commerce Cloud: HY_COM 2205, COM_CLOUD 2211, 2211-JDK21
References
Get alerted when CVE-2026-44761 or the next vulnerability affects your stack