medium2026-05-12SAP Commerce CloudCVE-2025-68161
Improper Certificate Validation in SAP Commerce Cloud Log4j Component
SAP Commerce Cloud (Apache Log4j dependency)
Our Take
Bundle with the critical Commerce Cloud rebuild (Note 3733064) into the same maintenance window.
Vulnerability Detail
Improper certificate validation in the Apache Log4j dependency shipped with SAP Commerce Cloud could allow man-in-the-middle attacks against outbound HTTPS connections from the platform.
Patch Action
Apply SAP Note 3716450.
Affected Versions
HY_COM 2205
COM_CLOUD 2211
Patch Info