CVE-2025-24875: SAP SE SAP Commerce

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.

Affected products

• SAP SE SAP Commerce

Published 2025-02-11. Last modified 2026-06-17.