CVE-2026-24321 — Information Disclosure vulnerability in SAP Commerce Cloud

CVE-2026-24321

Information Disclosure vulnerability in SAP Commerce Cloud PUBLISHED

Description (CNA)

SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Commerce Cloud	affected HY_COM 2205; affected COM_CLOUD 2211; affected 2211-JDK21

CWE

CWE-359

References

https://me.sap.com/notes/3687771
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.