References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

{"timestamp":"2026-07-14T12:49:05.791735Z","id":"CVE-2026-44761","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-1392

https://me.sap.com/notes/3753495

https://url.sap/sapsecuritypatchday

[{"vendor":"SAP_SE","product":"SAP Commerce Cloud","defaultStatus":"unaffected","versions":[{"version":"HY_COM 2205","status":"affected"},{"version":"COM_CLOUD 2211","status":"affected"},{"version":"2211-JDK21","status":"affected"}]}]