CVE-2026-24321: fallo de gravedad media en SAP_SE SAP Commerce Cloud
Information Disclosure vulnerability in SAP Commerce Cloud
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.2%
SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
SAP_SE · SAP Commerce CloudCVEs relacionadas — SAP_SE SAP Commerce Cloud
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-42481HIGHImproper Access Control vulnerability in SAP Commerce CloudEPSS 0.5%CVE-2026-44761CRITICALInsecure Sample Credentials in SAP Commerce CloudEPSS 0.5%CVE-2024-33003HIGHInformation Disclosure Vulnerability in SAP Commerce CloudEPSS 0.5%CVE-2025-42906MEDIUMDirectory Traversal vulnerability in SAP Commerce CloudEPSS 0.4%CVE-2025-27435MEDIUMInformation Disclosure Vulnerability in SAP Commerce CloudEPSS 0.2%CVE-2024-47577LOWInformation Disclosure vulnerability in SAP Commerce CloudEPSS 0.2%