CVE-2025-26654 Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)
Attackers can intercept confidential data sent over unencrypted HTTP before the redirect to HTTPS occurs, impacting data confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-26654?
CVE-2025-26654 is a medium-severity vulnerability in SAP_SE SAP Commerce Cloud (Public Cloud), published on 8 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request before the redirect may be impacted if the client is configured to use HTTP and sends confidential data on the first request before the redirect.
Weakness: CWE-319
Which versions are affected by CVE-2025-26654?
How do I fix CVE-2025-26654?
No fix has been published for CVE-2025-26654 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-26654 being exploited?
There is no known exploitation of CVE-2025-26654 in the wild and no public exploit code.
Sources
Also known as GHSA-gj2r-xj7g-vp59.