SAP Commerce Cloud vulnerabilities

19 CVEs affecting SAP Commerce Cloud, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-24321, published 2026-02-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-0344: SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability, published 2019-08-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-09-30. EPSS: 7.1% chance of exploitation in the next 30 days. Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with…
CVE-2019-0322, published 2019-07-10. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing a service, either…
CVE-2020-26809, published 2020-11-10. Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days. SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders.…
CVE-2019-0343, published 2019-08-14. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application,…
CVE-2020-6238, published 2020-04-14. Critical severity, CVSS 9.3. EPSS: 1.3% chance of exploitation in the next 30 days. SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and…
CVE-2020-6232, published 2020-04-14. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check. This affects confidentiality of secure media.
CVE-2020-6201, published 2020-03-10. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP…
CVE-2023-39439, published 2023-08-08. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
CVE-2021-21445, published 2021-01-12. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation,…
CVE-2021-33666, published 2021-06-09. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware…

Latest

CVE-2026-24321, published 2026-02-10. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be…
CVE-2026-23684, published 2026-02-10. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value…
CVE-2024-33003, published 2024-08-13. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included…
CVE-2024-39597, published 2024-07-09. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the…
CVE-2023-42481, published 2023-12-12. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user…
CVE-2023-37486, published 2023-08-08. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On…