Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

SAP Commerce Cloud uses weak, public test credentials

CVE-2026-44761 · published 3 months ago
Summary

SAP Commerce Cloud may contain test credentials that are publicly known, which could be used by an attacker to access and modify data without a password. This is a concern because it could lead to unauthorized changes or data breaches. To fix this, update the credentials to unique and secret values.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sap_se sap commerce cloud HY_COM 2205
Original advisory text
Insecure Sample Credentials in SAP Commerce Cloud
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-1392Use of Default Credentials
Timeline
Published14 Jul 2026
Updated4 Nov 2026
First seen14 Jul 2026
Sources
CVE-2026-44761 · NVD
CVE-2026-44761 · MITRE
Track software like this
Free during beta