Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch

The Hacker Newsby @TheHackersNews ()2 min read3 · 3 reads
Read at thehackernews.com
AI summary · glm-5.3-flashSummaries by Vani AI

A maximum-severity (CVSS 10.0) unauthenticated RCE flaw in SAP Commerce Cloud, CVE-2026-58231, is under active exploitation days after patching.

CVE-2026-58231, rated 10.0 on CVSS, stems from insufficient authorization checks and input validation in SAP Commerce Cloud, enabling unauthenticated arbitrary code execution. Defused Cyber's honeypots detected exploitation attempts three days after the patch, and KEVIntel independently confirmed two attempts on August 14 from a US IP address. Onapsis urges customers to patch and rebuild, with an IP Filter Set offered as a temporary workaround. No actor attribution yet, though prior SAP NetWeaver flaw CVE-2025-31324 was exploited by China-nexus and criminal groups.

Key facts
  • CVE-2026-58231 (CVSS 10.0) allows unauthenticated RCE and compromise of internal components
  • Honeypot detections began three days post-patch; KEVIntel saw attempts August 14
  • Fixed builds must be patched, rebuilt, and redeployed per SAP guidance
  • IP Filter Set configuration available as temporary mitigation
Analyze CVE-2026-58231 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-58231CVE-2025-31324
ATT&CK
T1190 Exploit Public-Facing Application
Tags
authorization-bypasscloud-securitycommerce-cloudcve-2026-58231exploitationrcesap
Vendors
SAP
Products
SAP Commerce Cloud
Organizations
SAPOnapsisDefused CyberKEVIntel

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-31324
Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer
9.899%KEVRansomwarePoC
KEV
CVE-2026-58231
Unauthenticated Code Injection RCE in SAP Commerce Cloud
10.0<1%PoC

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Aug 15, 2026 Vulnerability / Cloud Security A maximum-severity security vulnerability impacting SAP Commerce Cloud is witnessing active exploitation efforts. The vulnerability, tracked as CVE-2026-58231 , is rated 10. 0 on the CVSS scoring system.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.