Commerce Cloud vulnerabilities | LiveThreat CVE Feed

Product

Commerce Cloud

by SAP · last CVE Feb 10, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities18 In the news0 Timeline

Severity mix

Critical 4High 4Medium 10Low 0

Severity

All severities18 Critical4 High4 Medium10 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Commerce Cloud to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-33666	6.1	1%	Jun 9	When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack… Affected: 100
CVE-2020-6201	6.1	1%	Mar 10	The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are… Affected: 6.6; 6.7; 1808; 1811; 1905
CVE-2026-23684	5.9	0%	Feb 10	Race condition vulnerability in SAP Commerce Cloud Affected: 2205; 2211
CVE-2021-21445	5.4	1%	Jan 12	SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper… Affected: 1808; 1811; 1905; 2005; 2011
CVE-2020-6272	5.4	1%	Oct 15	SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious… Affected: 1808; 1811; 1905; 2005
CVE-2020-6200	5.4	1%	Mar 10	The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS) that… Affected: 6.6; 6.7; 1808; 1811
CVE-2026-24321	5.3	0%	Feb 10	Information Disclosure vulnerability in SAP Commerce Cloud Affected: 2205; 2211
CVE-2020-26809	5.3	2%	Nov 10	SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to… Affected: 1808; 1811; 1905; 2005
CVE-2020-6232	5.3	1%	Apr 14	SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check Affected: 1811; 1905
CVE-2020-6363	4.6	1%	Oct 15	SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user Affected: 1808; 1811; 1905; 2005