CVE-2026-24321: SAP Commerce Cloud

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.

Affected products

• SAP Commerce Cloud: version 2205 only; version 2211 only

Published 2026-02-10. Last modified 2026-06-17.