A critical vulnerability in SAP Commerce Cloud, identified as CVE-2026-58231, is being actively exploited in the wild just days after a patch was released. The flaw, which carries a maximum CVSS score of 10.0, allows for unauthenticated arbitrary code execution and compromise of internal components.
According to SAP's advisory, the vulnerability stems from insufficient authorization checks and inadequate input validation. An unauthenticated attacker can exploit a default authentication client by submitting specially crafted input to certain functions that lack proper validation. Successful exploitation can severely impact the confidentiality, integrity, and availability of the application.
Security researchers at Defused Cyber reported observing exploitation attempts against their honeypots on August 14, 2026, only three days after SAP issued the patch. At the time of their discovery, no public proof-of-concept (PoC) for CVE-2026-58231 was known, and there was no prior indication of its exploitation.
The identity of the attackers currently exploiting this vulnerability remains unknown. However, previous critical SAP vulnerabilities have been targeted by various threat actors, including China-linked advanced persistent threat (APT) groups such as UNC5221 and UNC5174, as well as ransomware gangs.
