CVE-2026-44761 describes a vulnerability in SAP Commerce Cloud where a sample OAuth2 client retains default credentials publicly documented in SAP's sample configuration. If these credentials remain unchanged in a deployment, an unauthenticated attacker can leverage them to obtain valid access tokens and invoke APIs that allow reading and modifying data. The vulnerability is categorized under CWE-1392 (Use of Default Credentials). The CVSS 3.1 base score is 9.1, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity. No vendor advisory or patch information is currently available, and the affected versions are not specified.

Successful exploitation allows an unauthenticated attacker to gain access tokens using default OAuth2 client credentials, enabling unauthorized reading and modification of data via certain APIs. This results in a high impact on confidentiality and integrity of the affected system. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or guidance is provided, it is strongly recommended to change or remove any default or sample OAuth2 client credentials in SAP Commerce Cloud deployments to prevent unauthorized access. Monitor SAP's official advisories for updates.