CVE-2025-26654

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request before the redirect may be impacted if the client is configured to use HTTP and sends confidential data on the first request before the redirect.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-266553.1SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges th CVE-2025-266564.3OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attac CVE-2025-266575.3SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive infor CVE-2025-266586.8The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the applicati CVE-2025-266596.1SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vu CVE-2025-266604.3SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at defa CVE-2025-266618.8Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have CVE-2025-266624.4The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. W CVE-2025-266638.1Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.CVE-2025-266646.5Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-266657.0Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally.CVE-2025-266667.8Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.