SAP Commerce Cloud CVE-2026-58231 Exploited (CVSS 10.0)

SAP Commerce Cloud CVE-2026-58231 Is a CVSS 10.0 Unauthenticated RCE

SAP Commerce Cloud CVE-2026-58231, a maximum-severity CVSS 10.0 flaw that lets an unauthenticated attacker reach arbitrary code execution, is now being exploited in the wild, just three days after disclosure. SAP patched it on August 11, 2026; by August 14 honeypots run by Defused were logging exploitation attempts, and a public proof-of-concept became available on August 15 (confirmed independently by KEVIntel). The bug lives in the Data Hub Adapter, where a default authentication client combined with insufficient input validation lets crafted input hit functions that never check it. Patch to a fixed Commerce Cloud release and redeploy immediately, and as a stopgap restrict access to the vulnerable endpoint with an IP filter set. SAP shipped the fix alongside three other critical flaws, and the vulnerability is not yet in CISA's KEV catalog.

Update (August 17, 2026): exploitation began three days after disclosure; this post has been updated to reflect confirmed in-the-wild attacks and a public PoC.

The reason a 10.0 here is worse than the number suggests is where Data Hub sits. It is asynchronous data-staging middleware meant for backend ERP and CRM integration, so in a clean architecture it should never be reachable from the internet. In practice, monolithic deployments, shared ingress rules, and hybrid cloud-to-on-prem bridges routinely leave Data Hub paths reachable through the primary storefront domain. When that happens, SAP Commerce sits on the boundary between public e-commerce and internal ERP, and a compromised adapter becomes an immediate pivot toward financial and supply-chain systems. That is the blast radius that makes this a patch-now item even without a public exploit.

The August update did not stop at Commerce Cloud. SAP also fixed CVE-2026-44772 (CVSS 9.9), a code-injection flaw in Manufacturing Integration and Intelligence, and CVE-2026-34265 (CVSS 9.8), an out-of-bounds issue, so the patch cycle is heavy across the SAP estate this month.

Is CVE-2026-58231 being exploited?

Yes. What was a patch-immediately warning at disclosure is now confirmed in-the-wild exploitation. Defused reported its honeypots seeing attempts on August 14, three days after SAP's August 11 fix, and KEVIntel independently confirmed attacks, noting a public PoC became available on August 15. That is the exact pattern this class of flaw follows: an unauthenticated, maximum-severity code-execution bug in an internet-adjacent commerce platform gets weaponized within days of the patch becoming diffable. SAP security firm Onapsis urged customers to apply the fix and then redeploy the updated Commerce Cloud version, because a patch that is not redeployed is not actually running.

How do I reduce exposure before the full patch and redeploy?

Cut the reachability of the Data Hub Adapter. Configure an IP filter set to restrict access to the vulnerable endpoint, and at the WAF or CDN layer drop external requests to Data Hub paths so only trusted internal systems can reach it. Confirm whether blocking that external traffic affects live checkout, which it generally should not, since Data Hub handles background catalog and inventory sync rather than the storefront path. Review access logs for abuse of the default authentication client while you stage the build.

Our read

Understanding risk means asking not just how severe a flaw is, but what it is wired into. A 10.0 on a standalone app is bad; a 10.0 on the adapter that bridges your public storefront to your ERP is a lateral-movement launchpad, and the CVSS number alone will not tell you that. This is where an accurate picture of your own attack surface matters more than the score: the organizations exposed here are the ones that did not know Data Hub was reachable from the internet. Patch and redeploy, filter the endpoint, and verify continuously which internal middleware is actually exposed rather than assuming your architecture keeps it private.

Reporting by The Hacker News; severity and remediation per SAP's security notes, Onapsis, and NVD. Sources linked above.

Related: Adobe ColdFusion CVE-2026-48362 and three CVSS 10.0 flaws · Metabase zero-day: unauthenticated SQL injection to admin