CVE-2026-44761

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1392

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-447623.7SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive d CVE-2026-447637.6SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain function CVE-2026-447647.3Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send CVE-2026-447657.3Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker cou CVE-2026-447666.5SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain fun CVE-2026-447676.1setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored a CVE-2026-447684.1SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Co CVE-2026-447695.5SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing t CVE-2026-44773.1A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPA CVE-2026-447704.3SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific CVE-2026-447714.3SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access inform CVE-2026-447749.9Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a