CVE-2025-26654: SAP Commerce Cloud Information Disclosure

CVE-2025-26654 Overview

SAP Commerce Cloud (Public Cloud) exposes an unencrypted HTTP listener on port 80 that cannot be fully disabled. The platform only supports redirecting HTTP traffic to HTTPS on port 443 rather than blocking cleartext connections outright. Clients configured to send the initial request over HTTP transmit that request in cleartext before the redirect occurs. Any confidential data included in that first request may be observed or modified by an attacker positioned on the adjacent network path. The weakness maps to [CWE-319] Cleartext Transmission of Sensitive Information.

Critical Impact
Confidential data sent in the first pre-redirect HTTP request to SAP Commerce Cloud may be intercepted or tampered with by an adversary on the local network segment.

Affected Products

SAP Commerce Cloud (Public Cloud)
Deployments accepting connections on TCP port 80
Client integrations that initiate requests over http:// rather than https://

Discovery Timeline

2025-04-08 - CVE-2025-26654 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26654

Vulnerability Analysis

SAP Commerce Cloud (Public Cloud) enforces HTTPS by issuing an HTTP redirect from port 80 to port 443. Operators cannot disable the port 80 listener entirely. The redirect model assumes clients will discard the initial cleartext connection and re-establish the session over TLS.

That assumption breaks when a client sends payload data in the first HTTP request. The request body, headers, cookies, and any embedded credentials or session tokens traverse the network before the server issues the redirect. An attacker with access to the adjacent network can capture or alter this traffic.

The issue is a configuration and design limitation rather than a code defect. The exploit requires the victim client to be misconfigured to use http:// and to include sensitive data on the initial request.

Root Cause

The root cause is the absence of an administrative option to disable the plaintext HTTP listener. Because port 80 must remain open to service the redirect, any client that speaks HTTP first will leak that first request. HTTP Strict Transport Security (HSTS) mitigates repeat visits but does not protect the very first connection from a client that has never contacted the origin.

Attack Vector

An adversary on the same broadcast domain, VLAN, or Wi-Fi segment as the client can passively sniff traffic destined for TCP port 80 on the Commerce Cloud endpoint. The attacker reads any confidential fields the client sends, such as authentication tokens, API keys, or personally identifiable information. An active on-path attacker can additionally modify the request or strip the redirect and serve a malicious response.

Exploitation requires a misconfigured client and adjacent network access, which raises attack complexity. No authentication is required on the server side. Refer to SAP Note #3543274 for vendor technical details.

Detection Methods for CVE-2025-26654

Indicators of Compromise

Outbound client connections to SAP Commerce Cloud endpoints on TCP port 80 rather than 443
HTTP 301 or 302 redirect responses from Commerce Cloud that contain sensitive data in the preceding client request
Application logs showing requests received on the HTTP listener that include authorization headers, session cookies, or POST payloads

Detection Strategies

Inspect web access logs and load balancer logs for requests arriving on port 80 with non-empty bodies or sensitive headers
Correlate client integration source code and configuration files against the http:// scheme to identify vulnerable callers
Use network monitoring to flag any cleartext HTTP session directed at Commerce Cloud hostnames

Monitoring Recommendations

Alert on any HTTP request to Commerce Cloud that contains Authorization, Cookie, or X-API-Key headers before the redirect
Track the ratio of port 80 to port 443 traffic per client integration and investigate anomalies
Monitor for on-path attack indicators such as ARP spoofing or rogue DHCP on segments hosting Commerce Cloud clients

How to Mitigate CVE-2025-26654

Immediate Actions Required

Reconfigure all client applications, mobile apps, and server-side integrations to use https:// URLs exclusively when calling SAP Commerce Cloud
Rotate any credentials, tokens, or API keys that may have been transmitted over HTTP prior to remediation
Enforce HSTS on client browsers and preload the Commerce Cloud domain where possible to prevent future cleartext attempts

Patch Information

Apply the vendor guidance published in SAP Note #3543274 and review the corresponding SAP Security Patch Day bulletin. Because the platform does not permit disabling port 80, the practical fix is client-side enforcement of HTTPS combined with vendor-recommended configuration changes.

Workarounds

Configure client HTTP libraries to reject the http:// scheme when targeting Commerce Cloud hostnames
Deploy HSTS with a long max-age and the includeSubDomains directive on any upstream reverse proxy under your control
Restrict Commerce Cloud client execution to network segments protected against passive sniffing and on-path attacks

bash

# Example: enforce HTTPS-only for a client integration using curl
curl --proto '=https' --tlsv1.2 \
  -H "Authorization: Bearer $TOKEN" \
  https://commerce.example.com/api/v2/orders