A critical remote code execution vulnerability in SAP Commerce Cloud, identified as CVE-2026-58231, is reportedly being exploited in active attacks just three days after a patch was released. The flaw, which carries a maximum severity rating, affects the core Data Hub Adapter extension of the e-commerce platform, formerly known as SAP Hybris.
Threat intelligence firm Defused confirmed that exploitation attempts against CVE-2026-58231 have been observed hitting their honeypots. This comes despite the absence of a public proof-of-concept (PoC) for the vulnerability. SAP has acknowledged the issue and is investigating the reports of active exploitation.
According to SAP's description, the vulnerability stems from an improper authorization weakness that allows an unauthenticated attacker to leverage a default authentication client. By submitting specially crafted input to functions lacking sufficient validation, attackers can execute arbitrary code. Successful exploitation could lead to the compromise of internal components, severely impacting the confidentiality, integrity, and availability of the application.
SAP released Security Note 3771065 on its August Patch Day, recommending that customers and partners apply the patch immediately. The company has not yet officially flagged CVE-2026-58231 as actively exploited in its security advisories.
SAP Commerce Cloud is a widely used cloud-based e-commerce platform, serving online stores for numerous high-profile global brands and large retailers. The internet security watchdog group Shadowserver has identified over 4,200 internet-exposed IP addresses with an SAP Commerce Cloud fingerprint, primarily located in Europe and North America. It is currently unknown how many of these instances have been secured against the newly reported attacks.
This incident follows a series of recent security fixes by SAP. In July 2026, the company addressed 16 vulnerabilities, and in May and June, it patched 30 more, including three other critical flaws (CVE-2026-44761, CVE-2026-22732, and CVE-2026-34263) also affecting the Commerce Cloud platform. Earlier in April, a supply chain attack involving compromised official SAP npm packages was reported, aimed at stealing developer credentials.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has previously added 14 SAP vulnerabilities to its Known Exploited Vulnerabilities catalog since November 2021, with three of these having been exploited in ransomware attacks. SAP, a German multinational software corporation, serves 99 of the 100 largest companies globally and reported over 36 billion in revenue in fiscal year 2025.
