Medium severity · published Feb 10, 2026
CVE-2026-24321
Information Disclosure vulnerability in SAP Commerce Cloud
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
SAP Commerce Cloud · SAP_SE
HY_COM 2205; COM_CLOUD 2211; 2211-JDK21 · source: vendor
CC
Commerce Cloud · Sap
2205; 2211 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24321
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24321
Permissions Required
https://me.sap.com/notes/3687771
Vendor Advisory
https://url.sap/sapsecuritypatchday
More from SAP Commerce Cloud
9.1
CVE-2026-44761
Insecure Sample Credentials in SAP Commerce Cloud
9.1
CVE-2024-33003
Information Disclosure Vulnerability in SAP Commerce Cloud
5.9
CVE-2026-23684
Race condition vulnerability in SAP Commerce Cloud
5.3
CVE-2025-42906
Directory Traversal vulnerability in SAP Commerce Cloud
4.2
CVE-2025-27435
Information Disclosure Vulnerability in SAP Commerce Cloud