SAP Commerce Cloud CVE-2026-58231 Already Under Attack: Maximum Risk for Exposed Installations

A Critical Vulnerability Observed in Honeypots

CVE-2026-58231, a critical SAP Commerce Cloud flaw, is already being targeted in exploitation attempts. Defused, a threat intelligence company, reported the activity on August 14, 2026, after detecting the first attempts in its honeypots.

According to BleepingComputer, SAP had patched the vulnerability three days earlier. The National Vulnerability Database record was published on August 11, 2026, and updated on August 12. SAP, however, had not yet officially classified the flaw as actively exploited in its advisory.

This creates a discrepancy between Defused’s operational observations and the classification in the NVD database. Defused reported real-world attempts against its monitoring systems, while the CISA SSVC field cited by NVD indicates exploitation: none. The same field nevertheless classifies the vulnerability as automatable and having total technical impact.

No public PoC is currently available, and Defused says CVE-2026-58231 had not previously been known to be exploited.

The Flaw Affects the Data Hub Adapter

CVE-2026-58231 affects the Data Hub Adapter extension in SAP Commerce Cloud. The weakness involves authorization controls and the handling of a default authentication client.

An unauthenticated remote attacker can send specially crafted input to functions that do not perform sufficient validation. The attack requires no credentials, user interaction, or complex technical conditions.

According to the NVD record, the flaw is classified as CWE-94, improper control of code generation, a category associated with code injection. In practice, exploitation can lead to arbitrary code execution and compromise of internal application components.

The CVSS 3.1 score is 10.0, the maximum possible rating. The vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

This indicates a network-based attack with low complexity that requires neither authentication nor user interaction. Confidentiality, integrity, and availability may all be severely affected, including beyond the directly vulnerable component.

Affected Versions and Potential Exposure

The affected product is SAP Commerce Cloud (Data Hub Adapter), identified in the NVD catalog as a product from SAP_SE. The configurations listed as vulnerable are:

• COM_CLOUD 2211;
• 2211-JDK21.

Corrected build numbers, unaffected versions, and official workarounds separate from SAP’s fix have not been disclosed. The primary technical reference is SAP Note 3771065, together with the SAP Security Patch Day page.

SAP Commerce Cloud was previously known as SAP Hybris. The platform is used by online stores operated by major brands and international retailers, making the potential compromise of an exposed instance particularly significant.

Shadowserver provides an indication of the Internet-facing attack surface, identifying more than 4,200 IP addresses associated with an SAP Commerce Cloud fingerprint. Most are located in Europe and North America. However, it is not known how many systems are honeypots, how many have already been updated, or how many are actually vulnerable to attacks targeting CVE-2026-58231.

A Second Critical Issue Involves OAuth2

The risk is not limited to the Data Hub Adapter flaw. SAP Commerce Cloud is also affected by CVE-2026-44761, a critical vulnerability with a CVSS 3.1 score of 9.1.

The flaw affects a sample OAuth2 client that may remain in the SAP Help portal configuration with publicly documented credentials. If administrators do not replace those credentials, an unauthenticated attacker can use them to obtain a valid token.

The token can be used to call APIs capable of reading and modifying data. The impact is therefore high for confidentiality and integrity, while availability is not affected. The vulnerability is classified as CWE-1392, involving the use of default credentials.

The affected versions listed are:

• HY_COM 2205;
• COM_CLOUD 2211;
• 2211-JDK21.

The relevant SAP reference is SAP Note 3753495. Organizations should specifically check for sample OAuth2 clients, replace publicly documented credentials, and rotate any secrets that are still in use.

SAP Has Previously Been Targeted Through Exploited Flaws

This disclosure follows a series of critical issues affecting the SAP ecosystem. Other SAP Commerce Cloud vulnerabilities cited include:

• CVE-2026-22732, CVSS 9.1;
• CVE-2026-34263, CVSS 9.6;
• CVE-2026-44761, CVSS 9.1.

SAP fixed 16 vulnerabilities in its July 2026 Security Patch package and another 30 in the packages released in June and May.

Since November 2021, CISA has added 14 SAP vulnerabilities to its Known Exploited Vulnerabilities catalog. According to reports, three of them have been used in ransomware attacks. CVE-2026-58231 has not been added to the KEV catalog, and no CISA remediation deadline has been reported.

This context increases the operational risk for organizations using Commerce Cloud, particularly when instances are Internet-accessible and connected to order management, customer, catalog, and payment systems.

What Administrators Should Do

The priority is to apply the fix associated with SAP Note 3771065 and the SAP Security Patch Day release. Organizations should also:

1. identify which Commerce Cloud instances are publicly exposed;
2. check for default authentication clients and credentials;
3. apply the guidance in SAP Note 3753495 for CVE-2026-44761;
4. rotate any remaining sample credentials and secrets;
5. review Data Hub Adapter and OAuth2 API logs;
6. look for unauthenticated requests, anomalous input, and unexpected access attempts.

No indicators of compromise, detection rules, or specific remediation procedures have been published. Logs should therefore be analyzed alongside exposure timelines, requests originating from unusual networks, and any subsequent activity consistent with code execution or the abuse of OAuth2 tokens.

The presence of attempts against honeypots does not, by itself, prove that every exposed system has been compromised. However, given the CVSS 10.0 severity, remediation should not be delayed while waiting for further public confirmation.