CVE-2020-6238: SAP Commerce Cloud

Critical severity, CVSS 9.3. EPSS: 1.3% chance of exploitation in the next 30 days.

SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce.

Affected products

• SAP Commerce Cloud: version 6.6 only; version 6.7 only; version 1808 only; version 1811 only; version 1905 only

Published 2020-04-14. Last modified 2026-06-17.