SAP Commerce Cloud CVE-2026
Attackers actively exploit unauthenticated RCE CVE-2026-58231 (CVSS 10.0) in SAP Commerce Cloud days after patch release.
CVE-2026-58231, a maximum-severity flaw in SAP Commerce Cloud (CVSS 10.0), allows unauthenticated attackers to abuse a default authentication client and bypass insufficient validation, achieving arbitrary code execution and compromise of internal components. Defused Cyber researchers observed exploitation attempts against honeypots only three days after SAP released the patch. The flaw had no public PoC and was not previously known to be exploited. The attackers are unknown, though past critical SAP flaws have been exploited by China-linked groups UNC5221 and UNC5174 and ransomware gangs.
- Unauthenticated RCE via default authentication client and insufficient validation, CVSS 10.0
- Honeypots caught exploitation attempts three days after SAP's patch; no public PoC exists
- Prior critical SAP flaws were exploited by China-linked UNC5221/UNC5174 and ransomware gangs
- CVEs
- CVE-2026-58231
- Vendors
- SAP
- Products
- SAP Commerce Cloud
- Organizations
- Defused CyberSecurityAffairs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58231 | Unauthenticated Code Injection RCE in SAP Commerce Cloud | 10.0 | <1% | PoC |
From the original article
1 min read at securityaffairs.com
Attackers are actively exploiting a maximum severity SAP Commerce Cloud vulnerability, tracked as CVE-2026-58231, just days after SAP released a patch. A critical SAP Commerce Cloud vulnerability, tracked as CVE-2026-58231 (CVSS score of 10. 0), is under active exploitation just days after SAP released a patch.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.