SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials…

SAP Commerce Cloud ships a *sample* OAuth2 client that exists to let admins copy-paste through the getting-started guide. The client ID and secret are published verbatim in SAP Help Portal documentation, so if an operator never removed or rotated that client after go-live, an unauthenticated remote attacker can hit the /authorizationserver/oauth/token endpoint, receive a valid access token, and then call OCC/REST APIs to read or modify data. Affected releases are HY_COM 2205, COM_CLOUD 2211, and COM_CLOUD 2211-JDK21; SAP addressed it in July 2026 Security Patch Day.

SAP's 9.1 / CRITICAL rating matches reality for the default-configuration case. The vector is AV:N/AC:L/PR:N/UI:N — unauthenticated, network, low complexity, high confidentiality *and* integrity impact — and the target is an e-commerce platform holding customer PII, order records, and pricing logic. The only reason a given tenant might not be exploitable is if the operator followed hardening guidance and deleted the sample client; that is a configuration accident away, not a technical mitigation. Treat as CRITICAL until proven otherwise on each instance.

Why this verdict

• Unauthenticated + published credentials: the attacker doesn't guess, brute-force, or phish — they copy-paste from SAP Help Portal. AC:L/PR:N is not aspirational, it is literal.
• Role multiplier: SAP Commerce Cloud is by definition a high-value role — customer PII, B2B pricing, order pipelines, payment context. Chain end is mass data read/modify. Floor is CRITICAL for this component class.
• Configuration-dependent, not architecture-dependent: every tenant that skipped the 'delete sample client' step in the hardening checklist is exposed. This is not a narrow version window — it spans three major release trains (2205, 2211, 2211-JDK21).
• Friction is thin: WAF/CDN in front of storefronts does not block /oauth/token; that endpoint is required for legitimate integrations. Rate-limiting slows enumeration but does not stop a targeted attacker.
• No KEV/PoC yet is a timing artifact — disclosed today. Trivially reproducible with public data, so weaponization is expected within days, not months.

Why not higher?

Already at the top severity bucket. No higher tier exists in the noisgate schema. A perfect 10 would require availability impact (A:H) or an unauth RCE giving code execution on the host; this bug is data-plane, not host-plane.

Why not lower?

Downgrading to HIGH would require evidence that ≥99% of installed base rotates the sample client at provisioning. SAP does not enforce removal, the default provisioning ships the client, and historic default-credential bugs in SAP show 10–30% residual exposure. Without installed-base evidence to the contrary, the CRITICAL floor holds.

1. Delete the sample OAuth2 client immediately — In SAP Commerce Backoffice or via impex, remove the sample client row from oauthclientdetails (the specific clientId is named in SAP Security Note for July 2026). This is the direct fix and applies within minutes — deploy within 3 days per noisgate mitigation SLA for CRITICAL, ideally within hours given the trivial exploit.
2. Block /authorizationserver/oauth/token at the WAF for the sample client_id — Add a WAF rule that inspects POST bodies to the token endpoint and rejects requests where client_id equals the published sample value. Buys time on tenants that cannot immediately restart Commerce nodes.
3. Rotate secrets for ALL non-sample OAuth2 clients — If the sample client was left in place, assume operator hygiene on other clients is also weak. Rotate every client secret and audit oauthclientdetails for stale integrations.
4. Audit access logs for the sample client_id going back 90 days — Search access and Tomcat logs for token issuance events referencing the sample client_id. Any hit from a non-SAP-owned IP is treated as an incident: assume PII/order data read.
5. Apply the SAP July 2026 Security Patch — The vendor fix removes the sample client from default provisioning and logs a warning at startup if still present. Apply within 90 days per noisgate remediation SLA for CRITICAL, sooner if you cannot verify the client has been deleted.

Run from an auditor workstation with network reachability to the Commerce Cloud storefront. Invoke as ./check-cve-2026-44761.sh https://shop.example.com <sample_client_id> <sample_client_secret>, supplying the sample client_id/secret from the SAP Security Note. No target-side privileges required — this is a black-box check against the public token endpoint.

#!/usr/bin/env bash
# noisgate check for CVE-2026-44761
# Detects whether SAP Commerce Cloud sample OAuth2 client is still active.
# Usage: ./check-cve-2026-44761.sh <base_url> <sample_client_id> <sample_client_secret>
# Exit 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
set -u

if [ "$#" -ne 3 ]; then
  echo "UNKNOWN: usage $0 <base_url> <client_id> <client_secret>" >&2
  exit 2
fi

BASE="${1%/}"
CID="$2"
CSEC="$3"
ENDPOINT="${BASE}/authorizationserver/oauth/token"

RESP=$(curl -sk -o /tmp/noisgate_44761.json -w "%{http_code}" \
  -X POST "$ENDPOINT" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=${CID}&client_secret=${CSEC}") || {
    echo "UNKNOWN: network failure contacting $ENDPOINT"
    exit 2
  }

case "$RESP" in
  200)
    if grep -q '"access_token"' /tmp/noisgate_44761.json; then
      echo "VULNERABLE: sample OAuth2 client issued a valid access token at $ENDPOINT"
      rm -f /tmp/noisgate_44761.json
      exit 1
    fi
    echo "UNKNOWN: HTTP 200 without access_token — inspect response"
    exit 2
    ;;
  400|401)
    echo "PATCHED: token endpoint rejected sample client credentials (HTTP $RESP)"
    rm -f /tmp/noisgate_44761.json
    exit 0
    ;;
  404)
    echo "UNKNOWN: token endpoint not found — verify base URL"
    exit 2
    ;;
  *)
    echo "UNKNOWN: unexpected HTTP $RESP from $ENDPOINT"
    exit 2
    ;;
esac

Sources

1. SAP Security Patch Day — July 2026 (vendor)
2. BleepingComputer — SAP fixes critical flaws in NetWeaver and Commerce Cloud
3. CSA Singapore advisory AL-2026-075
4. Cryptika — SAP Security Update July 2026
5. entplexit — SAP Security News 07/2026
6. heise — SAP Patchday July 2026
7. SAP Help Portal — Configuring OAuth Clients in Commerce
8. SAP KBA 3641255 — Moving to New OAuth Implementation in Commerce Cloud JDK 21