SAP SE SAP Commerce Cloud vulnerabilities

4 CVEs affecting SAP SE SAP Commerce Cloud, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-44761, published 2026-07-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-44761, published 2026-07-14. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged,…
CVE-2025-42906, published 2025-10-14. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not…
CVE-2025-27435, published 2025-04-08. Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days. Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow…
CVE-2024-47577, published 2024-12-10. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the…