Hackers exploit SAP Commerce Cloud flaw days after patch

Threat actors began exploiting a critical vulnerability in SAP Commerce Cloud identified as CVE-2026-58231 three days after the flaw was publicly disclosed. The bug lets an attacker bypass authorization checks and input validation to run arbitrary code on affected systems.

The flaw carries a CVSS score of 10. Successful exploitation can allow attackers to execute code and access internal components of Commerce Cloud environments, creating a pathway to further compromise if systems are not patched.

SAP released fixes for the vulnerability on Aug. 11. Threat intelligence firm Defused recorded exploitation attempts against its honeypots on Aug. 14. Independent observers operating proprietary sensors and private honeypots under the name KEVIntel observed attack traffic and reported that a public proof-of-concept exploit became available on Aug. 15.

CISA’s Known Exploited Vulnerabilities (KEV) catalog lists 14 SAP product vulnerabilities; only one entry affecting Commerce Cloud, CVE-2019-0344, was added to the KEV list in 2024. CVE-2026-58231 had not been added to the KEV catalog at the time of the latest observations.

Customers running Commerce Cloud instances should verify that SAP’s Aug. 11 patches are applied to their deployments. A public proof-of-concept release and recorded exploitation activity indicate unpatched systems remain at risk of scanning and attack attempts.