SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
SAP patched a CVSS 10.0 unauthenticated RCE flaw (CVE-2026-58231) in Commerce Cloud's Data Hub Adapter, plus three critical flaws in NetWeaver and Manufacturing.
SAP's August 2026 updates fix CVE-2026-58231, a CVSS 10.0 flaw in Commerce Cloud's Data Hub Adapter where insufficient authorization checks and input validation let unauthenticated attackers execute arbitrary code. Onapsis urged customers to patch and redeploy, with an IP Filter Set on the vulnerable endpoint offered as a temporary workaround. The update also fixed CVE-2026-44772 (CVSS 9.9) and CVE-2026-44758 (CVSS 9.1), code injection flaws in Manufacturing Integration and Intelligence involving SSRF and SSTI, and CVE-2026-34265 (CVSS 9.8), an out-of-bounds write in NetWeaver ABAP's DIAG protocol parsing that can leak information or crash systems.
- CVE-2026-58231 is a CVSS 10.0 unauthenticated RCE in Commerce Cloud's Data Hub Adapter
- IP Filter Set restricting the vulnerable endpoint serves as a temporary workaround
- Also fixed: CVE-2026-44772 (9.9) and CVE-2026-44758 (9.1) in Manufacturing Integration and Intelligence
- CVE-2026-34265 (9.8) is an out-of-bounds write in NetWeaver ABAP DIAG protocol parsing
- Products
- SAP Commerce CloudSAP NetWeaver
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-34265 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption | 9.8 | <1% | ||
| CVE-2026-44758 | SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected… | 9.1 | <1% | ||
| CVE-2026-44772 | — | — | — | ||
| CVE-2026-58231 | Unauthenticated Code Injection RCE in SAP Commerce Cloud | 10.0 | <1% | PoC |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Aug 12, 2026 Enterprise Security / Vulnerability SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in arbitrary code execution. The vulnerability, assigned the CVE identifier CVE-2026-58231 , is rated 10. 0 on the CVSS scoring system.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.