Known vulnerabilities in SAP Commerce Cloud

Known vulnerabilities in SAP Commerce Cloud

Vendor: SAP

Software: SAP Commerce Cloud

Software CPE: cpe:2.3:a:sap:sap_commerce_cloud:*:*:*:*:*:*:*:*

Website: https://www.sap.com/

Total vulnerabilities: 17

Public exploits: 4

Known exploited (KEV): 1

Highest CVSSv4 Score: 10

Breakdown by Severity Chart

Vulnerabilities (17)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU141510 - Improper Authorization CVE-2026-58231	CWE-285	Critical	No	No	-	12.08.2026	SB2026081202
#VU137497 - Use of Hard-coded Credentials CVE-2026-44761	CWE-798	Critical	No	No	-	14.07.2026	SB2026071484
#VU131177 - Improper Access Control CVE-2026-43515	CWE-284	Medium	Available	No	-	12.05.2026	SB2026051281 SB2026051592 SB2026060605 and 22 more
#VU131180 - Improper Authentication CVE-2026-43512	CWE-287	Medium	Available	No	-	12.05.2026	SB2026051281 SB2026051592 SB2026052607 and 22 more
#VU131182 - Improper input validation CVE-2026-41293	CWE-20	Medium	No	No	-	12.05.2026	SB2026051281 SB2026051592 SB2026052607 and 22 more
#VU117341 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2025-42906	CWE-22	Medium	No	No	-	17.10.2025	SB2025101732
#VU114316 - Resource exhaustion CVE-2025-5115	CWE-400	Medium	No	No	-	21.08.2025	SB2025082101 SB2025082751 SB20250828111 and 42 more
#VU101380 - Exposure of sensitive information to an unauthorized actor CVE-2024-47577	CWE-200	Low	No	No	-	10.12.2024	SB2024121019
#VU100588 - Improper Authentication CVE-2024-52316	CWE-287	Low	No	No	-	18.11.2024	SB2024111823 SB2024112550 SB2024112832 and 36 more
#VU98796 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2024-38819	CWE-22	Medium	Available	No	-	17.10.2024	SB2024101781 SB2024112849 SB2024120331 and 54 more
#VU98795 - Security Features CVE-2024-38820	CWE-254	Medium	No	No	-	17.10.2024	SB2024101781 SB2024112618 SB2024120428 and 40 more
#VU98527 - Insufficient Verification of Data Authenticity CVE-2024-45217	CWE-345	Medium	No	No	-	15.10.2024	SB2024101504 SB2024121856 SB2025021263 and 1 more
#VU98526 - Improper Authentication CVE-2024-45216	CWE-287	Medium	Available	No	-	15.10.2024	SB2024101504 SB2024121856 SB2025021263 and 1 more
#VU97934 - Deserialization of Untrusted Data CVE-2019-0344	CWE-502	Critical	No	Exploited	-	02.10.2024	SB2019081464
#VU97652 - Resource exhaustion CVE-2024-38286	CWE-400	Medium	No	No	-	23.09.2024	SB2024092355 SB2024100267 SB2024102808 and 26 more
#VU95819 - Exposure of sensitive information to an unauthorized actor CVE-2024-33003	CWE-200	Medium	No	No	-	13.08.2024	SB2024081348
#VU84578 - Improper Access Control CVE-2023-42481	CWE-284	Medium	No	No	-	19.12.2023	SB2023121954