CVE-2026-44761

{
  "id": "CVE-2026-44761",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-14T01:16:18.023",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability."
    },
    {
      "lang": "es",
      "value": "SAP Commerce Cloud podría retener un cliente OAuth2 de ejemplo con credenciales de ejemplo documentadas públicamente que se originan de una configuración de ejemplo proporcionada en la documentación del Portal de Ayuda de SAP. Si se dejan sin modificar, un atacante no autenticado podría usar estas credenciales conocidas para obtener un token de acceso válido e invocar ciertas API para leer y modificar datos. La explotación exitosa resulta en un alto impacto en la confidencialidad y la integridad, sin impacto en la disponibilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Commerce Cloud",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "HY_COM 2205",
              "status": "affected"
            },
            {
              "version": "COM_CLOUD 2211",
              "status": "affected"
            },
            {
              "version": "2211-JDK21",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-14T00:00:00+00:00",
          "id": "CVE-2026-44761",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1392"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3753495",
      "source": "[email protected]"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]"
    }
  ]
}