CVE-2026-44761

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3753495
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) SAP Commerce Cloud podría retener un cliente OAuth2 de ejemplo con credenciales de ejemplo documentadas públicamente que se originan de una configuración de ejemplo proporcionada en la documentación del Portal de Ayuda de SAP. Si se dejan sin modificar, un atacante no autenticado podría usar estas credenciales conocidas para obtener un token de acceso válido e invocar ciertas API para leer y modificar datos. La explotación exitosa resulta en un alto impacto en la confidencialidad y la integridad, sin impacto en la disponibilidad.

Information

Published : 2026-07-14 01:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-44761

Mitre link : CVE-2026-44761

CVE.ORG link : CVE-2026-44761

JSON object : View

Products Affected

No product.

CWE

CWE-1392

Use of Default Credentials

{"id": "CVE-2026-44761", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44761", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Commerce Cloud", "versions": [{"status": "affected", "version": "HY_COM 2205"}, {"status": "affected", "version": "COM_CLOUD 2211"}, {"status": "affected", "version": "2211-JDK21"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T01:16:18.023", "references": [{"url": "https://me.sap.com/notes/3753495", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-1392"}]}], "descriptions": [{"lang": "en", "value": "SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability."}, {"lang": "es", "value": "SAP Commerce Cloud podr\u00eda retener un cliente OAuth2 de ejemplo con credenciales de ejemplo documentadas p\u00fablicamente que se originan de una configuraci\u00f3n de ejemplo proporcionada en la documentaci\u00f3n del Portal de Ayuda de SAP. Si se dejan sin modificar, un atacante no autenticado podr\u00eda usar estas credenciales conocidas para obtener un token de acceso v\u00e1lido e invocar ciertas API para leer y modificar datos. La explotaci\u00f3n exitosa resulta en un alto impacto en la confidencialidad y la integridad, sin impacto en la disponibilidad."}], "lastModified": "2026-10-24T22:10:00.210", "sourceIdentifier": "cna@sap.com"}