Skip to content
OpenAdvisories

Product · SAP

SAP Commerce Cloud

13 known vulnerabilities.

SAP Commerce Cloud at a glance

Last 12 months
3
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 2 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability, 1 critical August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202611
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202620
Jan 202600
Dec 202500
Nov 202500
Oct 202510
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202510
Mar 202500
Feb 202500
Jan 202500
Dec 202410

Latest advisories

  • High max 9.1
    NCSC-2024-0472 13 CVEs

    Kwetsbaarheden verholpen in SAP producten

    SAP heeft kwetsbaarheden verholpen in SAP NetWeaver, ABAP, Web Dispatcher, Business Objects, HCM en Commerce Cloud.

    SAP
  • High max 9.8
    NCSC-2024-0333 21 CVEs

    Kwetsbaarheden verholpen in SAP producten

    SAP heeft kwetsbaarheden verholpen in diverse producten als SAP Business Objects, SAP HANA, Netweaver en Document Builder.

    SAP
All Critical High Medium Low Exploited only Public exploit

13 results · Feed

  • Critical 9.1
    CVE-2026-44761

    Insecure Sample Credentials in SAP Commerce Cloud

    SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known crede…

    SAP SAP Commerce Cloud
  • Medium 5.3
    CVE-2026-24321

    Information Disclosure vulnerability in SAP Commerce Cloud

    SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a l…

    SAP SAP Commerce Cloud
  • Medium 5.9
    CVE-2026-23684

    Race condition vulnerability in SAP Commerce Cloud

    A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data i…

    SAP SAP Commerce Cloud
  • Medium 5.3
    CVE-2025-42906

    Directory Traversal vulnerability in SAP Commerce Cloud

    SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured …

    SAP SAP Commerce Cloud
  • Medium 4.2
    CVE-2025-27435

    Information Disclosure Vulnerability in SAP Commerce Cloud

    Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow the attacker to use the disclosed coupon code, hence posing …

    SAP SAP Commerce Cloud
  • Low 2.7
    CVE-2024-47577

    Information Disclosure vulnerability in SAP Commerce Cloud

    Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in serv…

    SAP SAP Commerce Cloud
  • High 7.4
    CVE-2024-33003

    Information Disclosure Vulnerability in SAP Commerce Cloud

    Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successf…

    SAP SAP Commerce Cloud
  • High 8.1
    CVE-2023-42481

    Improper Access Control vulnerability in SAP Commerce Cloud

    In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Co…

    SAP SAP Commerce Cloud
  • Medium 4.7
    CVE-2021-33666

    When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certai…

    SAP SAP Commerce Cloud
  • Medium 5.4
    CVE-2021-21445

    SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated da…

    SAP SAP Commerce Cloud
  • Medium 5.3
    CVE-2020-26809

    SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission …

    SAP SAP Commerce Cloud
  • Unscored —
    CVE-2020-6363

    SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a u…

    SAP SAP Commerce Cloud
  • Medium 5.4
    CVE-2020-6272

    SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authent…

    SAP SAP Commerce Cloud