SAP SE SAP Commerce vulnerabilities

2 CVEs affecting SAP SE SAP Commerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-24875, published 2025-02-11.

More from SAP SE.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-39597, published 2024-07-09. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the…
• CVE-2025-24875, published 2025-02-11. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this…