CVE-2025-26654mediumCWE-319

CVE-2025-26654: medium-severity vulnerability in SAP_SE SAP Commerce Cloud (Public Cloud)

Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)

Published · Updated

Follow this CVE+ Monitor SAP Commerce Cloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.2%
SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request before the redirect may be impacted if the client is configured to use HTTP and sends confidential data on the first request before the redirect.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
SAP_SE · SAP Commerce Cloud (Public Cloud)