SYS::ONLINE
Wasteland.
Briefs1855
Issues23
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-58231 2026-08-11

SAP Commerce Cloud Hit With a Perfect 10: CVE-2026-58231 Enables Unauthenticated RCE

"SAP has disclosed a maximum-severity code injection flaw in the SAP Commerce Cloud Data Hub Adapter that, according to the vendor's advisory, could allow an unauthenticated attacker to achieve arbitrary code execution…"

SAP has disclosed a maximum-severity code injection flaw in the SAP Commerce Cloud Data Hub Adapter that, according to the vendor's advisory, could allow an unauthenticated attacker to achieve arbitrary code execution and compromise internal components.

What Is It

CVE-2026-58231 is a code injection vulnerability (CWE-94) in SAP Commerce Cloud. According to SAP's advisory, the flaw allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions that lack sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

The CVE was published on 2026-08-11 by SAP SE as the CNA, and currently sits in "Received" status at NVD. The technical details available so far come from SAP's own description; no independent analysis or proof-of-concept had been published at the time of writing.

Why It Matters

This carries a CVSS 3.1 base score of 10.0 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Every exploitability factor is worst-case: network-reachable, low attack complexity, no privileges required, and no user interaction. The scope is Changed, meaning exploitation reaches beyond the vulnerable component itself; consistent with the description's reference to compromising internal components. Exploitability scores 3.9 out of a possible 3.9. These are the vendor's own metrics, and NVD has not yet published an independent assessment.

The "default authentication client" detail matters operationally: based on SAP's wording, the abused entry point appears to be present by default rather than requiring an unusual configuration.

No public reporting of in-the-wild exploitation accompanied this disclosure. Defenders tracking exploitation status should check the CISA Known Exploited Vulnerabilities catalog directly, since KEV listings are added on CISA's own timeline and can change after a CVE is first published.

What's Vulnerable

SAP lists the affected product as SAP Commerce Cloud (Data Hub Adapter), with a default status of unaffected and the following versions marked affected:

No CPE entries were published in the NVD record.

Patch Status

SAP published this as part of its Security Patch Day release. Remediation guidance is in SAP Note 3771065, which requires an authenticated SAP support account to access. No workaround, mitigation, or required-action deadline is specified in the supplied data; administrators running the affected 2211 builds of the Data Hub Adapter should pull the note and apply the fix on SAP's guidance.

Sources