Apache Tomcat Vulnerabilities in SAP Commerce Cloud
SAP Commerce Cloud (Apache Tomcat)
SAP Commerce Cloud is having a rough patch cycle — this is the second note this month for the platform, plus the critical Spring Security note. Bundling 3747484 and 3748262 into one planned rebuild saves operational overhead. If you have a Commerce Cloud maintenance window already scheduled for the Spring Security fix, add this too.
Vulnerability Detail
Multiple Apache Tomcat vulnerabilities (CVE-2026-29145, CVE-2025-66614, CVE-2026-24734) bundled in the SAP Commerce Cloud embedded Tomcat server. The vulnerabilities allow unauthenticated attackers to exploit weaknesses in the Tomcat server including certificate validation bypass and other server-side flaws. High impact on confidentiality and integrity.
Patch Action
Apply SAP Note 3747484. Bundle with other open Commerce Cloud notes (3748262) into a single rebuild and redeployment window.
Affected Versions
Patch Info