CVE-2026-44761— Insecure Sample Credentials in SAP Commerce Cloud
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP Commerce Cloud | HY_COM 2205 | affected |
COM_CLOUD 2211 | affected | ||
2211-JDK21 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44761
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insecure Sample Credentials in SAP Commerce Cloud
Source: CVE Program / CVE List V5
Vulnerability Description
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1392
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Commerce Cloud 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Commerce Cloud是德国SAP公司的一套基于云的电子商务平台。该产支持销售管理、营销管理、订单管理和运营管理等。 SAP Commerce Cloud存在信任管理问题漏洞，该漏洞源于保留了一个带有公开文档中样例凭据的OAuth2客户端，可能导致未经验证的攻击者使用这些已知凭据获得有效访问令牌并调用API读写数据。以下版本受到影响：HY_COM 2205版本、COM_CLOUD 2211版本和2211-JDK21版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Commerce Cloud | HY_COM 2205 | - |
II. Public POCs for CVE-2026-44761
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44761
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44761 (1)
Same Patch Batch · SAP_SE · 2026-07-14 · 15 CVEs total
| CVE-2026-44747 | 9.9 CRITICAL | Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP |
| CVE-2026-27690 | 9.1 CRITICAL | HTTP Request Smuggling in SAP Approuter |
| CVE-2026-0487 | 8.4 HIGH | DLL Hijacking vulnerability in SAProuter on Microsoft Windows |
| CVE-2026-44752 | 8.2 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configur |
| CVE-2026-44745 | 8.1 HIGH | Open Redirect vulnerability in SAP Approuter |
| CVE-2026-58233 | 7.6 HIGH | Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsatt |
| CVE-2026-44767 | 6.1 MEDIUM | Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection |
| CVE-2026-44759 | 6.1 MEDIUM | Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-44769 | 5.5 MEDIUM | SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO) |
| CVE-2026-44760 | 4.7 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applica |
| CVE-2026-44771 | 4.3 MEDIUM | Missing Authorization check in SAP S/4HANA (Draft operation) |
| CVE-2026-44770 | 4.3 MEDIUM | Missing Authorization check in SAP S/4 HANA (Create Single Payment) |
| CVE-2026-44768 | 4.1 MEDIUM | Security misconfiguration in SAP CRM (WebClient UI) |
| CVE-2026-44753 | 3.7 LOW | Information Disclosure vulnerability in SAP HANA Extended Application Services classic mod |
IV. Related Vulnerabilities
Same product: SAP Commerce Cloud
- CVE-2026-24321
Information Disclosure vulnerability in SAP Commerce Cloud - CVE-2026-23684
Race condition vulnerability in SAP Commerce Cloud - CVE-2025-42906
Directory Traversal vulnerability in SAP Commerce Cloud - CVE-2025-27435
Information Disclosure Vulnerability in SAP Commerce Cloud - CVE-2024-47577
Information Disclosure vulnerability in SAP Commerce Cloud
Same vendor: SAP_SE
- CVE-2026-58231
Improper Authorization in SAP Commerce Cloud (Data Hub Adapt - CVE-2026-66779
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap - CVE-2026-66778
Multiple vulnerabilities in SAP Business AI Platform (Approu - CVE-2026-66777
Multiple vulnerabilities in SAP Business AI Platform (Approu - CVE-2026-66776
Multiple vulnerabilities in SAP Business AI Platform (Approu
Same weakness: CWE-1392
- CVE-2026-68503
LazyOwn: Default C2 Operator Credentials Enable Administrati - CVE-2026-41939
Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE v - CVE-2026-3144
IBM API Connect Default Credentials - CVE-2026-58466
AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add - CVE-2026-58453
JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials vi
V. Comments for CVE-2026-44761
No comments yet