Attackers are already trying to exploit a critical SAP Commerce Cloud security hole that can let outsiders take over vulnerable online store systems. The flaw, CVE-2026-58231, is a CVSS 10.0 unauthenticated remote code execution bug in the core Data Hub Adapter extension caused by improper authorization and insufficient input validation. Defused says it saw exploitation attempts in honeypots three days after SAP released fixes, and Shadowserver has observed more than 4,200 internet-exposed SAP Commerce Cloud fingerprints.
Why it matters: Organizations running SAP Commerce Cloud should treat this as urgent because attackers are probing for vulnerable systems almost immediately after patch release. Internet-facing retail and e-commerce deployments should be patched right away and checked for signs of compromise.
Eduard Kovacs
2026.08.17
98% relevant
This source directly updates the same event by adding that exploitation began three days after SAP disclosed and patched CVE-2026-58231, with sightings independently confirmed by Defused honeypots and KEVIntel, and noting that a public proof-of-concept appeared by August 15.
info@thehackernews.com (The Hacker News)
2026.08.15
99% relevant
This article appears to cover the same underlying event: exploitation attempts targeting SAP Commerce Cloud CVE-2026-58231 within days of SAP releasing a fix, reinforcing urgency for affected customers to patch.
Sergiu Gatlan
2026.08.14
100% relevant
This article establishes a new tracked event by adding the key escalation from patch availability to observed in-the-wild exploitation attempts against CVE-2026-58231 in SAP Commerce Cloud.
← Back to all stories