Threat actor

UNC5221

0 mentions in 7 days · 0 in 30 days · 1 total · first seen Aug 15, 2026 · last Aug 15, 2026

Timeline1 articles

SAP Commerce Cloud CVE-2026

Attackers actively exploit unauthenticated RCE CVE-2026-58231 (CVSS 10.0) in SAP Commerce Cloud days after patch release.

CVE-2026-58231, a maximum-severity flaw in SAP Commerce Cloud (CVSS 10.0), allows unauthenticated attackers to abuse a default authentication client and bypass insufficient validation, achieving arbitrary code execution and compromise of internal components. Defused Cyber researchers observed exploitation attempts against honeypots only three days after SAP released the patch. The flaw had no public PoC and was not previously known to be exploited. The attackers are unknown, though past critical SAP flaws have been exploited by China-linked groups UNC5221 and UNC5174 and ransomware gangs.

Security AffairsAug 15, 17:14 UTC · Aug 15, 2026Exploit / PoC in the wildCVE-2026-58231

Related CVEsby mentions

CVE-2026-5823110.02%
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking s
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.
—

Appears with

threat actor UNC5174 1 organization Defused Cyber 1 organization SecurityAffairs 1 product SAP Commerce Cloud 1 vendor SAP 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.