EUVD-2026-43591
GHSA-7xw7-hxcm-552f
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Default credential prevention
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Sap Commerce Cloud gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (sap) · only source for this CVE.
CVSS VectorVendor: sap
DescriptionCVE.org
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.
Articles & Coverage 1
Executive ViewAI
SAP Commerce Cloud deployments containing unremoved sample client configurations are vulnerable to credential-based attacks that could compromise business data integrity and customer information. No public exploit identified at time of analysis, but the threat is immediate given the publicly documented credentials, requiring urgent manual remediation since no vendor patch is available.
Within 24 hours, identify and disable or remove the sample OAuth2 client from all SAP Commerce Cloud environments and audit recent API access logs for unauthorized activity. Within 7 days, conduct forensic analysis to determine the extent of any data access or modification, and implement enhanced API authentication controls. Within 30 days, deploy automated credential detection mechanisms, enforce OAuth2 client secret rotation policies, and establish continuous monitoring for suspicious API patterns.
No vendor-released patch identified at time of analysis; remediation requires manual removal of the sample OAuth2 client from production systems. Implement API gateway security controls including validation, rate limiting, and IP restrictions. Monitor all OAuth2 token issuance and API access for anomalies. Remove public documentation exposing default credentials. Conduct forensic analysis of access logs to determine if exploitation has occurred.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB