Loading story…
SAP has patched a maximum-severity vulnerability in SAP Commerce Cloud (Data Hub Adapter), tracked as CVE-2026-58231, that could allow an unauthenticated attacker to achieve arbitrary code execution. The flaw affects COM_CLOUD 2211 and 2211-JDK21 and stems from improper authorization and insufficient input validation, enabling abuse of a default authentication client and specially crafted input to reach vulnerable functions. The issue is classified as CWE-94 and carries a CVSS score of 10.0, with potential impact across confidentiality, integrity, and availability.
SAP and Onapsis urged customers to upgrade to a fixed Commerce Cloud release and redeploy the updated version, while suggesting IP filtering as a temporary mitigation. SAP's broader August security update also addressed three additional critical flaws affecting Manufacturing Integration and Intelligence and Application Server ABAP for SAP NetWeaver and ABAP Platform, including code injection and memory corruption bugs that could lead to command execution, information disclosure, or system crashes.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
KEVIntel reported that a proof-of-concept exploit for SAP Commerce Cloud vulnerability CVE-2026-58231 had become available. This followed observed exploitation attempts and added new public technical detail about the flaw's weaponization.
A new CVE entry, CVE-2026-58231, was recorded for SAP Commerce Cloud (Data Hub Adapter). The flaw affects COM_CLOUD 2211 and 2211-JDK21 and can allow unauthenticated arbitrary code execution through improper authorization and insufficient input validation.
Defused reported that CVE-2026-58231 was being targeted in the wild, with first exploitation attempts hitting its honeypots three days after SAP's patch release. SAP had not yet marked the vulnerability as actively exploited in its advisory.
SAP released patches for the maximum-severity SAP Commerce Cloud vulnerability CVE-2026-58231 and, in its August 2026 security update, also fixed CVE-2026-44772, CVE-2026-34265, and CVE-2026-44758. SAP and Onapsis urged customers to upgrade and redeploy fixed versions, with IP filtering suggested as a temporary mitigation for the Commerce Cloud issue.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
12 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemkd-cirt.mk
Open sourcesecurityweek.com
Open sourceheise.de
Open sourcebleepingcomputer.com
Open sourcesocradar.io
Open sourcethehackernews.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP released multiple security updates addressing critical vulnerabilities across core enterprise products, including **SAP NetWeaver**, **SAP S/4HANA**, **SAP Commerce Cloud**, **SAP Business Warehouse**, **SAP Business Planning and Consolidation**, **SAP Kernel**, **ABAP Platform**, **SAP NetWeaver Application Server Java**, and **SAP Forecasting & Replenishment**. The fixes covered at least 15 vulnerabilities in both the April-to-June advisories, with several flaws rated **critical** and carrying CVSS scores from **9.0 to 9.9**. Reported impacts included **SQL injection**, **remote code execution**, **operating system command execution**, **directory traversal**, **memory corruption**, **sensitive data exposure**, **denial of service**, privilege abuse, and potential full compromise of confidentiality, integrity, and availability. Among the most severe issues, **CVE-2026-27681** affected SAP Business Planning and Consolidation and SAP Business Warehouse, allowing a low-privileged authenticated attacker to upload a file containing SQL commands and execute arbitrary database operations; SAP said a temporary mitigation was to revoke the `S_GUI` authorization object with Activity 60 (Upload) where possible. Additional high-risk flaws included **CVE-2026-34260** and **CVE-2026-34263** in SAP S/4HANA, SAP Commerce Cloud, and SAP Forecasting & Replenishment, each scored **9.6**, as well as critical June issues in NetWeaver-related components that could enable unauthorized access, file-processing abuse, and system compromise. SAP and national defenders urged organizations to apply vendor-specified patches immediately.
Jul 24, 2026
SAP released 15 new security notes to fix vulnerabilities across major product lines, with four critical issues demanding immediate attention in **SAP NetWeaver**, **SAP Commerce Cloud**, and **SAP Data Hub**. The most severe flaw, **`CVE-2026-44748`** (CVSS 9.9), is an XML signature wrapping weakness in SAML authentication for **SAP NetWeaver AS ABAP** and **ABAP Platform** that could let an authenticated attacker tamper with signed identity data, leading to unauthorized access and privilege escalation. SAP also patched **`CVE-2026-27671`** (CVSS 9.8), an unauthenticated memory corruption bug in the ABAP kernel’s RFC handling that can be triggered with crafted RFC requests. Other critical fixes include **`CVE-2026-40128`**, a directory traversal flaw in **SAP NetWeaver AS Java** Web Container, and **`CVE-2026-22732`**, a Spring Security issue affecting **SAP Commerce Cloud** and **SAP Data Hub** that could expose clients to connection hijacking. Additional patches addressed weaknesses in **SAP S/4HANA**, **ODP Data Replication APIs**, **SAP Wily Introscope Enterprise Manager**, **SAP MDG**, **SAP Business Objects**, and **SAP Fiori launchpad**, including SQL injection, reflected XSS, and Apache Log4j exposure. Canada’s Cyber Centre urged administrators to review SAP advisories, apply updates, and follow recommended mitigations across affected ABAP and Java environments.
Jun 29, 2026
SAP released its June Security Patch Day updates to fix multiple vulnerabilities across products including **SAP NetWeaver AS ABAP**, **ABAP Platform**, **SAP NetWeaver Application Server Java**, **SAP Commerce Cloud**, **SAP Data Hub**, **SAP S/4HANA**, **SAP Business Objects Business Intelligence Platform**, and **SAP Fiori launchpad**. The issues could allow cross-site scripting, denial of service, email spoofing, sensitive information disclosure, privilege escalation, data manipulation, arbitrary code execution, and unauthorized access. The most severe flaws include **`CVE-2026-44748`**, an XML Signature Wrapping weakness in SAML authentication affecting SAP NetWeaver AS ABAP and ABAP Platform with a **CVSS 9.9**, and **`CVE-2026-40128`**, a directory traversal vulnerability in the SAP NetWeaver Application Server Java Web Container rated **CVSS 9.0**. EG-FinCIRT said organizations should apply the patches as soon as testing is complete to reduce exposure across affected SAP environments.
Jul 12, 2026