CVE-2026-24321: sap_se sap commerce cloud

Vulnerability summary

CVE-2026-24321 is a medium (CVSS 5.3) vulnerability in sap_se sap commerce cloud. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.3% of scored vulnerabilities.

Timeline

1. 10-02-2026
   PublishedVulnerability first disclosed.
2. 10-02-2026
   Last modifiedVulnerability information updated.

Description

SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.

• CWE-359Exposure of Private Personal Information to an Unauthorized ActorThe product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.