CVE-2025-26654

SAP Commerce Cloud Public Cloud does not allow to disable unencrypted HTTP port 80 entirely, but instead allows a redirect from port 80 to 443 HTTPS. As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request befor...

CVE-2025-26654

creationtimestamp| type| source ---|---|--- 2025-04-08 07:46:37+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10871 2025-04-08 09:17:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmc5cjxzha2g 2025-04-08 11:29:21+00:00| seen| https://t.me/cvedetector/22432...

CVE-2025-26654 Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)

SAP Commerce Cloud Public Cloud does not allow to disable unencrypted HTTP port 80 entirely, but instead allows a redirect from port 80 to 443 HTTPS. As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request befor...

CVE-2025-26654

CVE-2025-26654 refers to SAP Commerce Cloud (Public Cloud) where HTTP traffic on port 80 is redirected to HTTPS (port 443) rather than being fully disabled. The vulnerability arises because the first request may be sent in plaintext before the redirect occurs, potentially compromising confidentia...