A maximum-severity vulnerability in SAP Commerce Cloud is reportedly facing exploitation attempts only days after SAP released a security update. Tracked as CVE-2026-58231, the flaw carries a CVSS score of 10.0 and affects the platform’s Data Hub Adapter component. Its rapid targeting highlights the risks organizations face when internet-facing enterprise software remains unpatched.
The vulnerability stems from insufficient authorization checks and inadequate input validation. According to the vulnerability description, an unauthenticated attacker can abuse a default authentication client and submit specially crafted input to functions that do not properly validate requests. Successful exploitation could allow arbitrary code execution and enable attackers to compromise internal components, potentially affecting the confidentiality, integrity, and availability of affected Commerce Cloud environments.
Threat intelligence company Defused Cyber reportedly observed exploitation attempts against its honeypot systems approximately three days after the patch was released. However, the company stated that the activity did not include a publicly available proof-of-concept and that confirmed exploitation in customer environments had not been established at the time of reporting. Even so, the short gap between patch availability and attack activity demonstrates how quickly threat actors can reverse-engineer or operationalize information about critical enterprise vulnerabilities.
SAP security specialists have urged customers to treat the issue as an emergency. Organizations using the affected Commerce Cloud release should apply the fixed version identified in SAP’s security guidance, rebuild the updated application, and redeploy it. Simply installing a component update may not be sufficient if the deployment process requires rebuilding and publishing a refreshed Commerce Cloud version. Administrators should also review logs, authentication activity, unusual requests, and unexpected changes to internal services for possible indicators of compromise.
If immediate patching is not possible, organizations can temporarily reduce exposure by configuring an IP Filter Set to restrict access to the vulnerable endpoint. Network controls should be considered only as a short-term mitigation, not a replacement for the official update. Security teams should identify all internet-facing SAP Commerce Cloud instances, confirm their versions, limit unnecessary access, and increase monitoring around the Data Hub Adapter. Previous attacks against critical SAP products, including NetWeaver, show that criminal and espionage groups have targeted SAP flaws for code execution, persistence, and data theft.
Read the original article: