Vulnerabilities & Exploits · Web App Attack

SAP Commerce Cloud faces probing days after patch

Defused says probes hit SAP Commerce Cloud Data Hub Adapter honeypots three days after the patch; KEVIntel separately logged two attempts on August 14 from one U.S. IP. Neither report identifies an attacker or confirms a successful compromise.

CVE.org describes CVE-2026-58231 as allowing an unauthenticated attacker to misuse a default authentication client and send crafted input to functions that do not validate it properly, potentially running code and compromising internal components.

Onapsis says SAP's fix requires rebuilding and redeploying the updated Commerce Cloud version, with an IP filter as a temporary workaround. For operators, a patch-level record alone may therefore overstate closure: if the updated build was not redeployed, the vulnerable endpoint may remain exposed during probing. The reports establish attempts, not successful access or who is behind them.

6 sources · Aug 17

CVE-2026-58231

NVD KEV

CVSS 10 CRITICAL: sAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation.

Timeline

Sources

Part of the PlainSec briefing for 2026-08-11

Every edition of this story: SAP Commerce Cloud faces probing days after patch

More from today