Max-Severity SAP Commerce Cloud Flaw (CVE-2026-58231, CVSS 10.0) Under Attack Three Days After Patch

CVE-2026-58231 is a maximum-severity improper authorization vulnerability in the Data Hub Adapter for SAP Commerce Cloud, and it’s already being probed in the wild — attackers hit honeypots with exploitation attempts just three days after SAP shipped the fix.

The score is 10.0 out of 10 on CVSS 3.1, the ceiling. SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client baked into the Data Hub Adapter and submit specially crafted input to functions that don’t validate it properly, resulting in arbitrary code execution. No credentials, no user interaction, no prior access to the target environment — just network reach to an exposed instance. That combination is what makes a flaw this severe attractive to opportunistic scanning within days of disclosure rather than weeks.

There’s no public proof-of-concept exploit circulating yet, and researchers haven’t confirmed successful compromise — what’s been observed so far is exploitation attempts hitting honeypots, meaning attackers are actively scanning for and probing vulnerable instances, not necessarily succeeding against production systems yet. That window won’t stay open long. Every SAP RCE with a public disclosure and no PoC has historically gotten one within one to three weeks, and honeypot activity this early is a strong signal that a working exploit chain already exists somewhere.

The affected surface is SAP Commerce Cloud 2211 deployments running the Data Hub Adapter, which is common in retail and B2B commerce implementations that sync product, pricing, and order data between SAP Commerce and external systems. SAP has released the fix as Security Note 3771065.

What to do now: apply Security Note 3771065 immediately if you haven’t, then redeploy the corrected application — patching the underlying platform without redeploying the running application doesn’t close the hole, since the vulnerable code path lives in the deployed Commerce application itself. After redeployment, verify the running environment actually reflects the fixed release rather than assuming the patch took; SAP environments with multiple deployment slots or staged rollouts are the most common place this step gets missed. If your Data Hub Adapter instance is internet-facing and you can’t confirm the patch is live right now, treat it as compromised until proven otherwise and pull it off the public network while you verify.

Sources

Related reading