OAuth2 Client Vulnerability in SAP Commerce Cloud
CVE-2026-44761

9.1CRITICAL

Key Information:

Vendor

SAP
Status
SAP Commerce Cloud
Vendor
CVE Published:
14 July 2026

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2026-44761?

SAP Commerce Cloud contains a vulnerability where a sample OAuth2 client, equipped with publicly available credentials from the SAP Help Portal documentation, may remain unchanged. This presents a significant security risk, as an unauthenticated attacker could utilize these predictable credentials to gain valid access tokens. Once obtained, the attacker can invoke certain APIs, potentially compromising confidentiality and integrity by accessing and altering sensitive data. Immediate attention to the configuration and management of these credentials is essential to prevent unauthorized access.

Affected Version(s)

SAP Commerce Cloud HY_COM 2205

SAP Commerce Cloud COM_CLOUD 2211

SAP Commerce Cloud 2211-JDK21

News Articles

favicon imageThe Hacker News

SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data

SAP patches three critical flaws, including a 9.9 NetWeaver ABAP memory bug and default OAuth credentials that may expose Commerce Cloud data.

References

https://me.sap.com/notes/3753495
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

.