CVE-2026-44761
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
SAP Commerce Cloud may retain a sample OAuth2 client with publicly documented sample credentials from sample configuration in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.
Risk Assessment
Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability. The organization risks unauthorized access to sensitive data and the ability to modify it.
Recommendation
Immediately remove or change the default credentials of the sample OAuth2 client in SAP Commerce Cloud as per vendor recommendations. Regularly review OAuth client configurations and remove any unused or sample entries.
Original NVD description (English source)
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.