What is the CVSS score of CVE-2026-44761?

CVE-2026-44761 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Sap Commerce Cloud are affected by CVE-2026-44761?

SAP Commerce Cloud deployments containing unremoved sample client configurations are vulnerable to credential-based attacks that could compromise business data integrity and customer information.

How to fix or mitigate CVE-2026-44761?

Within 24 hours, identify and disable or remove the sample OAuth2 client from all SAP Commerce Cloud environments and audit recent API access logs for unauthorized activity. Within 7 days, conduct forensic analysis to determine the extent of any data access or modification, and implement enhanced API authentication controls. Within 30 days, deploy automated credential detection mechanisms, enforce OAuth2 client secret rotation policies, and establish continuous monitoring for suspicious API patterns.

Sap Commerce Cloud CVE-2026-44761

EUVD-2026-43591 CRITICAL

Use of Default Credentials (CWE-1392)

2026-07-14 sap

GHSA-7xw7-hxcm-552f

SAP Information Disclosure Sap Commerce Cloud

9.1

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (sap) · only source for this CVE.

CVSS VectorVendor: sap

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 01:18 vuln.today

CVE Published

Jul 14, 2026 - 00:20 cve.org

CRITICAL 9.1

DescriptionCVE.org

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.

Articles & Coverage 1

News Critical Authentication Bypass via Default OAuth2 Credentials in SAP Commerce Cloud - CVE-2026-44761 Jul 14, 2026

AnalysisAI

Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed.