SAP patched CVE-2026-58231 on 11 August 2026. Three days later, exploitation attempts were already landing, with no public exploit code in circulation. The flaw is an unauthenticated remote code execution vulnerability in the SAP Commerce Cloud Data Hub Adapter, rated 10.0 on the CVSS scale.
The Vulnerability
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-58231 |
| SAP Security Note | 3771065 |
| CVSS v3.1 | 10.0, Critical / HotNews |
| Affected Component | SAP Commerce Cloud, Data Hub Adapter |
| Affected Versions | COM_CLOUD 2211, COM_CLOUD 2211-JDK21 |
| Fixed In | 2211.55, 2211-jdk21.17, or later |
| Prerequisites | None. Unauthenticated, no user interaction |
The Data Hub Adapter ships with a default authentication client. An unauthenticated attacker can abuse that client to reach internal functions that check neither the caller's authorization nor the input they receive. Submitting crafted input to those functions enables arbitrary code execution and compromise of internal platform components.
The affected component is what raises the severity. Data Hub is the integration layer between the Commerce storefront and back-end systems such as ERP, CRM, order management, and payment processors. Code execution there sits upstream of order and payment data, and inherits the service accounts configured for every one of those integrations.
Exploitation Status
Threat intelligence firm Defused reported exploitation attempts reaching its honeypot sensors on 14 August, three days after the patch and with no public proof-of-concept available. What has been reported so far is attempt traffic against sensors. No confirmed compromises or indicators of compromise have been published.
Shadowserver reports over 4,200 internet-exposed SAP Commerce Cloud instances, concentrated in Europe and North America.
Recommended Actions
-
Upgrade and redeploy: Move to 2211.55 or 2211-jdk21.17 or later, then rebuild and redeploy the Commerce application. Applying the note alone does not remediate Commerce Cloud, because the running production build must carry the change. Include CVE-2026-42945 (CVSS 8.1, Note 3773203, vulnerable bundled NGINX) in the same deployment.
-
Restrict the endpoint immediately: Configure an IP Filter Set to limit Data Hub Adapter access to trusted source systems, independently of the patch timeline. The adapter should not be reachable from the internet.
-
Rotate the default authentication client credentials: The patch closes the abuse path but does not invalidate credentials an attacker may already have obtained.
-
Check for prior exposure: Review Data Hub Adapter access logs for anomalous unauthenticated requests predating your patch date, and look for unexpected deployed extensions, new administrative accounts, or unexplained outbound connections from Commerce nodes.
