SAP Commerce Cloud ships sample OAuth2 client with publicly documented credentials
SAP Commerce Cloud retained a sample OAuth2 client whose credentials were documented in SAP Help Portal. If left unchanged, an unauthenticated attacker can use those well-known values to obtain a valid access token and read or modify tenant data via certain APIs. NVD scored 9.1.
- Vendor
- SAP
- Product
- Commerce Cloud (sample OAuth2 client shipped from documentation)
- CVSS
- 9.1
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-44761 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-44761 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
A default-credentials flaw in SAP Commerce Cloud. NVD assigns CVSS 3.1 = 9.1 — no authentication, no user interaction, network-reachable, high impact on confidentiality and integrity.
What the flaw is (per NVD): “SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.”
There is a particular flavor of vulnerability that keeps returning across decades: the sample credential shipped in the documentation, left in place by a deploying team that either did not read the note about changing it or assumed the vendor’s sample would not be honored on a real production tenant. It is not the sort of bug that gets a fresh name; it is the same mistake, different decade. The 9.1 score is not on the attacker — the credentials were public — it is on the deployment.
Status: SAP fixed this on the July 2026 Security Patch Day (published 2026-07-14). No known exploitation in the wild at time of writing, per BleepingComputer’s summary of the patch day.
What to do: Apply the July 2026 SAP Security Note and, separately, audit whether the sample OAuth2 client is still enabled in your Commerce Cloud tenants — the patch removes the shipped default, but a tenant that provisioned around the sample rather than rotating it needs the credential rotated independently.
- SAP July 2026 Security Patch Day — SAP Support Portal (authenticated).
- BleepingComputer coverage, 2026-07-14.
- NVD entry.
Other SAP CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-58231 SAP Commerce Cloud Data Hub Adapter Unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-44747 SAP NetWeaver AS ABAP memory-corruption via logical errors in memory managementwrite-up | [ CRITICAL ] | 9.9 | 0.6% | — |
| CVE-2026-27690 SAP AppRouter HTTP request smuggling in Node.js middlewarewrite-up | [ CRITICAL ] | 9.1 | 0.7% | — |
| CVE-2025-42999 SAP NetWeaver Deserialization Vulnerabilityransomware use | [ CRITICAL ] | 9.1 | 12.7% | |
| CVE-2025-31324 SAP NetWeaver Unrestricted File Upload Vulnerabilityransomware use | [ CRITICAL ] | 10.0 | 99.5% | |
| CVE-2017-12637 SAP NetWeaver Directory Traversal Vulnerability | [ HIGH ] | 7.5 | 95.1% | |
| CVE-2019-0344 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 7.1% | |
| CVE-2022-22536 SAP Multiple Products HTTP Request Smuggling Vulnerability | [ CRITICAL ] | 10.0 | 97.9% |
