HTTP Redirection Vulnerability in SAP Commerce Cloud by SAP
CVE-2025-26654

6.8MEDIUM

Key Information:

Vendor

SAP
Status
SAP Commerce Cloud (public Cloud)
Vendor
CVE Published:
8 April 2025

What is CVE-2025-26654?

SAP Commerce Cloud's inability to fully disable unencrypted HTTP on port 80 poses a significant risk as it allows HTTP traffic to be redirected to HTTPS. This design flaw can compromise the confidentiality and integrity of data transmitted during the initial client request made over HTTP, prior to the redirect. Clients that inadvertently connect via HTTP may expose sensitive information, creating a potential vulnerability for businesses relying on secure communications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

SAP Commerce Cloud (Public Cloud) COM_CLOUD 2211

References

https://me.sap.com/notes/3543274
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.