Configured Commerce: COM-2026-03 - Password History Policy Bypass

Updated November 10, 2026 21:23

Brief Description:

A medium-severity issue concerning password history policy bypass was identified in the Commerce B2B application which allows a user to cycle through 8 new temporary passwords to arrive back at their original weak or potentially compromised password.

Affected Versions:

All versions before 5.2.2605.

Solutions and Mitigations:

The application has been updated to institute a password change cool down as well as not allowing previously used passwords.

CVSS and Severity:

CVSS 4.3, Medium

CVE/CWE ID:

CWE-841

Configured Commerce: COM-2026-03 - Password History Policy Bypass

<%= previousTitle %>

<%= nextTitle %>

In this article

<%= heading %>

<% if (!block.description) { %> <%= block.name %> <% } else { %> <%= block.name %> <% } %>

<%= heading %>

<% if (!block.description) { %> <%= parsed.title %> <% } else { %> <%= parsed.title %> <% } %>

User Research

Security Announcements

Still have questions?

Categories

Toggle navigation menu

<%= category.name %>