CVE-2026-58231

SAP Commerce Cloud CVE-2026-58231 Critical Flaw Exploited in the Wild Just Three Days After Patch

SAP Commerce Cloud has been hit by a maximum-severity vulnerability tracked as CVE-2026-58231 that carries a CVSS score of 10.0. The flaw resides in the Data Hub Adapter component and allows unauthenticated remote code execution via a single crafted HTTP request. SAP released the official patch on 11 August, yet honeypots recorded the first exploitation attempts only three days later on 14 August. More than 4,200 internet-facing SAP Commerce Cloud instances have been identified worldwide, primarily in Europe and North America. Researchers note that AI-assisted patch analysis enabled attackers to weaponize the fix at unprecedented speed. Organizations are urged to apply the updates to versions 2211.55 or 2211-jdk21.17 immediately and restrict access to the affected endpoints in the meantime.

SAP Releases August 2026 Security Patch Day Advisories Including Four Critical Vulnerabilities

SAP published 28 new security advisories on August 11, 2026, aligned with the monthly Patch Tuesday schedule. Four of these received the highest severity rating of Critical. The most severe issue affects SAP Commerce Cloud Data Hub Adapter with an authorization bypass flaw rated CVSS 10.0. Two code injection vulnerabilities were disclosed in SAP Manufacturing Integration and Intelligence with CVSS scores of 9.9 and 9.1. A memory corruption vulnerability impacting SAP NetWeaver and ABAP Platform received a CVSS score of 9.8. The release also incorporates one GitHub advisory and two updates to previously published advisories.

SAP Releases August Security Update Patching 28 Vulnerabilities Including Critical CVSS 10 Flaw

SAP has issued a broad security update to address multiple critical vulnerabilities that could enable code injection, memory corruption, and privilege escalation across enterprise systems. The August package includes 28 new security notes along with a GitHub advisory and two prior fix updates. The highest-severity issue, CVE-2026-58231, carries a maximum CVSS score of 10 and affects the Data Hub Adapter in SAP Commerce Cloud versions 2211 and 2211-JDK21, allowing remote exploitation without user interaction due to improper authorization. Another critical flaw, CVE-2026-44772 rated 9.9, impacts SAP Manufacturing Integration and Intelligence 15.4 and 15.5, permitting malicious code injection into industrial process monitoring systems. Additional vulnerabilities rated 9.1 and lower cover directory traversal, SQL injection, XSS, XXE, hardcoded credentials, and OS command injection across various corporate components. Administrators are advised to identify affected systems and prioritize installation of the critical patches first.