CVE-2026-24321

5.3 mediumEPSS 0.2%

Medium (5.3) in sap commerce cloud. EPSS 0.2% chance of exploitation in the next 30 days.

SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-359
Published: 2026-02-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sap:commerce_cloud

References

https://me.sap.com/notes/3687771
https://url.sap/sapsecuritypatchday

Check your stack JSON