Use of hard-coded credentials in SAP Commerce Cloud - CVE-2026-44761
Published: July 14, 2026
Vulnerability identifier: #VU137497
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44761
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to sensitive information and modify data.
The vulnerability exists due to use of insecure sample credentials in SAP Commerce Cloud when exposed services are deployed with default credentials. A remote attacker can authenticate with sample credentials to gain unauthorized access to sensitive information and modify data.
Affected software
SAP Commerce Cloud
How to mitigate CVE-2026-44761
Install security update from vendor's website.