Advisory
A note with CVSS 7.4 for component CEC-SCC-COM-SRC-SER was released by SAP on 08.09.2026. The correction/advisory 3791068 was described with "[CVE-2026-2332] CLRF Injection vulnerability due to use of Jetty components in SAP Commerce Cloud (Search And Navigation)" and affects the system type SAP Commerce Cloud.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as none.
The vulnerability addressed is clrf injection vulnerability within SAP Commerce Cloud.
Risk specification
SAP Commerce Cloud uses a version of the Jetty components that may be vulnerable to CVE-2026-2332. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunked request containing a CR-LF sequence within a quoted chunk extension string, causing Jetty to incorrectly interpret the request boundary and smuggle an additional HTTP request to the backend server. Successful exploitation could have a high impact on the confidentiality and integrity of the application, with no impact on availability.
Solution
SAP Commerce Cloud addresses these potential vulnerabilities by upgrading Jetty to a non-vulnerable version. The following SAP Commerce Cloud patch release contains the updated libraries: SAP Commerce Cloud Patch Release 2211-jdk21.18 To download the corrected patch, please follow the steps below: Navigate to SWDC using your S-user credentials: [https://me.sap.com/softwarecenter/search/CX%2520Commerce](https://me.sap.com/softwarecenter/search/CX%2520Commerce) Select the appropriate product category, locate the package referenced in the Security Note, and identify the specific patch/fix level mentioned in the Security Note. Verify that the patch name matches the Security Note reference and download the patch file. For information on installing SAP Commerce patches, see About Patch Releases. After installing an SAP Commerce patch, customers must re-build and re-deploy the updated SAP Commerce version. Customers of SAP Commerce Cloud in Public Cloud should follow the corresponding build and deploy instructions. Customers of SAP Commerce Cloud on SAP Infrastructure should follow the build instructions and request deployment through a support ticket. Customers of SAP Commerce OnPrem should follow the corresponding build and deploy instructions. Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "Please assess the workaround applicability for your SAP landscape prior to implementation. Note that this workaround is a temporary fix and is not a permanent solution. SAP strongly recommends you apply the corrections outlined in the security note, which can be done in lieu of the workaround or after the workaround is implemented. SAP Commerce documentation already requires that Solr is not publicly exposed — it must only be accessible from trusted internal networks. Deployments that follow this requirement are not reachable by unauthenticated remote attackers, which prevents exploitation of this HTTP request smuggling vulnerability. If a reverse proxy is placed in front of Solr, it must be configured to reject or strip HTTP/1.1 chunk extensions (Transfer-Encoding: chunked with ;ext=... tokens) before forwarding requests to Jetty, as most proxy servers (e.g., nginx, Apache httpd) do by default.".
