Critical SAP Commerce Cloud flaw exploited days after patch with no public exploit

Attackers began exploiting a critical SAP Commerce Cloud flaw within days of its patch, even though no public proof-of-concept exists. Tracked as CVE-2026-58231 and scored 10.0, the improper-authorization bug in the Data Hub Adapter lets an unauthenticated attacker abuse a default authentication client and send crafted input to reach arbitrary code execution. Threat intelligence firm Defused saw the first exploitation attempts hit its honeypots three days after SAP's August patch, classified as automated mass scanning of internet-facing deployments. Shadowserver tracks more than 4,200 exposed SAP Commerce Cloud systems, mostly in Europe and North America. Prior critical SAP flaws have been used by state actors and ransomware crews.

Check

Apply SAP's August patch for Commerce Cloud immediately per Security Note 3771065, then re-deploy the updated version, and prioritize any internet-facing or hybrid deployment as an emergency.

Affected

Organizations running unpatched SAP Commerce Cloud (CVE-2026-58231); an unauthenticated attacker can reach arbitrary code execution with low complexity, and exploitation is already underway despite no public exploit code.

Fix

Patch and re-deploy now, restrict access to Commerce Cloud from untrusted networks, review the Data Hub Adapter and application logs for suspicious requests and code execution, and monitor for follow-on compromise.