← News
/DISPATCH · 2026-08-17

CVE-2026-58231: Unauthenticated SAP Commerce Cloud RCE Exploited in the Wild; CVSS 10.0 Triggers Global Emergency Patching

CVE-2026-58231, an unauthenticated RCE in the Commerce Cloud Data Hub Adapter patched on SAP August Patch Day, scores CVSS 10.0. Honeypots captured exploitation attempts 3 days later. Shadowserver observed 4200+ internet-exposed fingerprints. Retail and energy widely affected.

Incident Overview

CVE-2026-58231 is an incorrect authorization flaw in the SAP Commerce Cloud Data Hub Adapter, patched on SAP August 2026 Patch Day (11 August). Assigned CVSS v3.1 10.0. Unauthenticated remote attackers abuse a default authentication client, submit crafted requests to insufficiently validated functions, execute arbitrary code, and compromise internal application components. Affects COM_CLOUD 2211 and COM_CLOUD 2211-JDK21. Highest-severity item under SAP Security Note 3771065 that month.

Timeline and In-the-Wild Exploitation

Technical Details

CVE-2026-58231 stems from abuse of a default authentication client in the Data Hub Adapter. Data Hub Adapter is the key SAP Commerce Cloud component for exchanging and importing data with external systems. Attackers bypass authorization checks and submit crafted input to its API. Application-layer authentication is not enforced and input validation is insufficient; the chain completes RCE. SAP rates attack complexity Low; no user interaction; no prior privileges required.

Cloud Security Alliance and BlackTree analyses both stress: no public PoC is available to copy. Attackers can still build exploit attempts within days by analyzing patch diffs and identifying patched code paths. Widespread AI-assisted analysis continues to shrink the window between patch release and exploitation attempts.

Impact Assessment

As of disclosure, Shadowserver observed 4200+ SAP Commerce Cloud fingerprint IPs on the internet, mainly in Europe and North America. No accurate count exists of how many have Data Hub Adapter enabled and remain unpatched. Worst case: after gaining application control, the attacker reaches every integrated system the app is authorized to connect to — ERP, CRM, inventory, payment, and fulfillment — maximum impact on confidentiality, integrity, and availability.

Further Observations

By comparison, SAP June and July 2026 Security Patch Days fixed 30 and 16 vulnerabilities respectively. CVE-2026-44761, CVE-2026-22732, and CVE-2026-34263 also targeted the Commerce Cloud line and were rated Critical. Since November 2021, CISA has catalogued 14 SAP vulnerabilities exploited in the wild; 3 tied directly to ransomware crews. Attacks on SAP platforms show strong industrial compounding. This case again shows that when a large enterprise platform serving retail, energy, and manufacturing ships a 10.0 patch, the patch diff itself is high-quality input for rapidly building exploit code.

Remediation and Mitigation

References