SAP has disclosed a maximum-severity code injection flaw in the SAP Commerce Cloud Data Hub Adapter that, according to the vendor's advisory, could allow an unauthenticated attacker to achieve arbitrary code execution and compromise internal components.
What Is It
CVE-2026-58231 is a code injection vulnerability (CWE-94) in SAP Commerce Cloud. According to SAP's advisory, the flaw allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions that lack sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.
The CVE was published on 2026-08-11 by SAP SE as the CNA, and currently sits in "Received" status at NVD. The technical details available so far come from SAP's own description; no independent analysis or proof-of-concept had been published at the time of writing.
Why It Matters
This carries a CVSS 3.1 base score of 10.0 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Every exploitability factor is worst-case: network-reachable, low attack complexity, no privileges required, and no user interaction. The scope is Changed, meaning exploitation reaches beyond the vulnerable component itself; consistent with the description's reference to compromising internal components. Exploitability scores 3.9 out of a possible 3.9. These are the vendor's own metrics, and NVD has not yet published an independent assessment.
The "default authentication client" detail matters operationally: based on SAP's wording, the abused entry point appears to be present by default rather than requiring an unusual configuration.
No public reporting of in-the-wild exploitation accompanied this disclosure. Defenders tracking exploitation status should check the CISA Known Exploited Vulnerabilities catalog directly, since KEV listings are added on CISA's own timeline and can change after a CVE is first published.
What's Vulnerable
SAP lists the affected product as SAP Commerce Cloud (Data Hub Adapter), with a default status of unaffected and the following versions marked affected:
COM_CLOUD 22112211-JDK21
No CPE entries were published in the NVD record.
Patch Status
SAP published this as part of its Security Patch Day release. Remediation guidance is in SAP Note 3771065, which requires an authenticated SAP support account to access. No workaround, mitigation, or required-action deadline is specified in the supplied data; administrators running the affected 2211 builds of the Data Hub Adapter should pull the note and apply the fix on SAP's guidance.
Sources
- NVD, CVE-2026-58231: https://nvd.nist.gov/vuln/detail/CVE-2026-58231
- SAP Note 3771065: https://me.sap.com/notes/3771065
- SAP Security Patch Day: https://url.sap/sapsecuritypatchday
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog