SAP Commerce Cloud’s CVE-2026-58231 was being exploited within three days of public disclosure, with SAP issuing patches on August 11, honeypots seeing attacks on August 14, and a public proof of concept appearing on August 15. The flaw carries a CVSS score of 10 and can be used to execute arbitrary code and reach internal components.
The bug sits in a trusted authentication client built into the platform, so an outsider can reach sensitive code paths without normal login credentials. Once that path is reached, specially crafted input can slip past checks it should fail and trigger attacker code, which means a storefront exposure can turn into backend compromise rather than a simple web-app issue.
For teams running Commerce Cloud in production, the exposure is the internet-facing instance itself: if it is reachable, the attack path may not depend on stolen credentials or a prior foothold. That makes the window between disclosure and weaponization especially short for environments that sit in front of internal commerce services.