Login Request a demo
CC
Product
Commerce Cloud
by SAP · last CVE Feb 10, 2026
On CISA KEVExploited in the wild
18
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 4High 4Medium 10Low 0
Severity
All severities18Critical4High4Medium10Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Commerce Cloud to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2019-0344
In wildKEV
9.8
7%
Aug 14
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
Affected: 6.4; 6.5; 6.6; 6.7; 1808; 1811; +1 more
CVE-2023-39439
9.8
1%
Aug 8
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase
Affected: 2211
CVE-2020-6238
9.3
1%
Apr 14
SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation
Affected: 6.6; 6.7; 1808; 1811; 1905
CVE-2024-33003
9.1
0%
Aug 13
Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher…
Affected: 1811; 1905; 2005; 2011; 2105; 2205; +2 more
Showing 4