Advisory
SAP takes the security of its vast product portfolio very seriously and thus releases security fixes for
vulnerabilities reported by external researchers and their customers every second Tuesday of the month.
SAP Note 3787345
was released on
08.09.2026 and deals with
"[CVE-2026-34477] Security Misconfiguration vulnerability due to use of Apache Log4j in SAP Commerce Cloud (Search and Navigation)" within SAP Commerce Cloud.
We advice you to follow the instructions, to resolve
security misconfiguration
with a
medium potential for exploitation
in component CEC-SCC-COM-SRC-SER.
According to SAP Security Advisory team a workaround exists. It is advisable to implement the correction as none.
Risk specification
SAP Commerce Cloud uses a version of the Apache logging library (Log4j) that does not properly enforce hostname verification for TLS connections, potentially allowing an authenticated user to manipulate data transmitted over the network. This vulnerability could have a high impact on the integrity of the application, with no impact on confidentiality or availability.
Solution
SAP Commerce addresses this vulnerability by upgrading Apache Log4j to a non-vulnerable version. The following SAP Commerce patch releases include the updated libraries: SAP Commerce Cloud Patch Release 2211-jdk21.13 SAP Commerce Cloud Patch Release 2211.53 To download the corrected patch, please follow the steps below: Navigate to SWDC using your S-user credentials: [https://me.sap.com/softwarecenter/search/CX%2520Commerce](https://me.sap.com/softwarecenter/search/CX%2520Commerce) Select the appropriate product category, locate the package referenced in the Security Note, and identify the specific patch/fix level mentioned in the Security Note. Verify that the patch name matches the Security Note reference and download the patch file. For information on installing SAP Commerce patches, see About Patch Releases. After installing an SAP Commerce patch, customers must re-build and re-deploy the updated SAP Commerce version. Customers of SAP Commerce Cloud in Public Cloud should follow the corresponding build and deploy instructions. Customers of SAP Commerce Cloud on SAP Infrastructure should follow the build instructions and request deployment through a support ticket. Customers of SAP Commerce OnPrem should follow the corresponding build and deploy instructions. Alternativly, the consulting team has proposed the following: "None". The suggestion may be considered, as a workaround or compensating mitigation. We recommend installing/applying the correction wherever possible and as soon as possible. Base your decision on whether or not to apply the patch on your companies and systems risk perspective and consider the provided CVSS 5.9 score.
