Summary
CVE-2026-44761 is a critical default credentials vulnerability (CWE-1392) in SAP Commerce Cloud, affecting versions HY_COM 2205, COM_CLOUD 2211, and COM_CLOUD 2211-JDK21. SAP has assigned this a CVSS 3.1 base score of 9.1 (Critical). The platform may retain a sample OAuth2 client whose credentials are publicly documented in SAP Help Portal documentation; if left unchanged following deployment — a common misconfiguration — an unauthenticated remote attacker can use those well-known credentials to obtain a valid OAuth2 access token and invoke authenticated APIs to read and modify business-critical e-commerce data.
Technical details
- Root cause: SAP Commerce Cloud ships with a sample OAuth2 client configuration — including a client ID and secret — that is documented in SAP Help Portal sample setup guides. If this sample client is not removed or reconfigured during deployment, its credentials remain valid and exploitable. This is classified under CWE-1392 (Use of Default Credentials).
- Trigger conditions: Any SAP Commerce Cloud instance that retains the sample OAuth2 client with its publicly documented default credentials is exploitable. No prior access, elevated privileges, or user interaction is required — a default or incompletely hardened deployment is sufficient.
- Attack vector: An unauthenticated remote attacker submits a token request to the Commerce Cloud OAuth2 endpoint (e.g.,
/authorizationserver/oauth/token) using the known sample client credentials to obtain a valid bearer token. That token is then used to make authenticated calls against the OCC (Omni-Commerce Connect) REST API layer. - Impact: Successful exploitation grants an attacker full authenticated API access, enabling them to read sensitive e-commerce data — including customer records, order history, catalog information, and pricing — and to write or modify that data. The vulnerability yields high confidentiality and high integrity impact with no impact on availability.
Affected software
- SAP Commerce Cloud – HY_COM 2205
- SAP Commerce Cloud – COM_CLOUD 2211
- SAP Commerce Cloud – COM_CLOUD 2211-JDK21
Severity
CVSS v3.1 base score: 9.1 (Critical)
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate — apply the vendor patch: Apply SAP Security Note 3753495, available via the SAP Support Portal at
me.sap.com/notes/3753495. This note addresses the retained sample OAuth2 client configuration in the affected versions listed above. - If patching is not immediately possible: Audit all active OAuth2 client registrations in your SAP Commerce Cloud instance. Any client whose credentials match those present in SAP Help Portal sample configuration documentation must be disabled or have its credentials rotated immediately. Check backoffice OAuth client management and relevant configuration files (e.g.,
local.properties,project.properties) for sample client entries. - Network-level mitigation: Restrict access to the OAuth2 token endpoint (
/authorizationserver/oauth/token) at the network perimeter to known and authorized IP ranges until the patch is applied and sample clients have been audited.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.