CVE-2026-58231

CVE-2026-58231 is a code injection flaw (CWE-94) in SAP Commerce Cloud where an unauthenticated attacker can abuse a default authentication client and submit specially crafted input to functions that lack sufficient input validation. Because the issue is reachable over the network with no privileges or user interaction required (CVSS 3.1 base score 10.0, scope changed), a successful exploit allows arbitrary code execution and compromise of internal application components, with high impact on confidentiality, integrity, and availability. Any organization running SAP Commerce Cloud — typically large enterprises operating internet-facing B2C/B2B storefronts — is affected. A public proof-of-concept is available on GitHub, and news reports indicate targeted exploitation attempts began within days of the patch release; the flaw is not yet in CISA's KEV catalog and EPSS estimates a 1.7% chance of exploitation in the next 30 days.

What to do: Apply the fix from SAP's security advisory immediately, treating this as urgent given the public proof-of-concept and reported post-patch targeting; do not rely on version numbers not listed here — verify with SAP which builds are patched. Restrict network access to the affected commerce endpoints and the default authentication client, and review application and access logs for anomalous unauthenticated requests since at least the patch date. Cloud customers should confirm SAP has applied the patch to their tenants and audit tenant logs for exploitation attempts.