A maximum severity level vulnerability was detected in SAP Commerce Cloud, for which patches have been released by SAP. The vulnerability would allow arbitrary code execution.
The flaw is tracked as CVE-2026-58231 and carries a CVSS score of 10.0. It is a case of insufficient authorization checks and input validation.
The following is an overview of the SAP Commerce Cloud vulnerability and what organizations should do.
Important Vulnerability Details
- This flaw is applicable to SAP Commerce Cloud (Data Hub Adapter)
- This vulnerability enables unauthenticated users to exploit the use of a default authentication client
- Attackers can submit specially crafted input to certain functions
- These functions have no proper validation
- Exploitation results in arbitrary code execution
- There are impacts on confidentiality, integrity, and availability
Technical Details
The SAP Commerce Cloud vulnerability stems from insufficient authorization checks. According to the CVE.org description, the flaw allows unauthenticated attackers to abuse a default authentication client.
The attacker submits specially crafted input to certain functions. These functions lack sufficient validation.This is due to the fact that arbitrary code can be executed.
The vulnerability has been rated 10.0 using the Common Vulnerability Scoring System (CVSS).
This reflects the severity of the impact:
- Confidentiality: High impact
- Integrity: High impact
- Availability: High impact
What Organizations Should Do
Onapsis, a SAP security company, has urged customers to take immediate action:
Immediate Steps:
- Patch to a fixed Commerce Cloud release immediately
- Re-deploy the updated SAP Commerce Cloud version
- This is the only complete fix for the vulnerability
Temporary Workaround:
- Configure an IP Filter Set to restrict access to the vulnerable endpoint
- This reduces exposure until a patch can be applied
- This is not a permanent solution
Other Critical SAP Vulnerabilities
SAP has also addressed three other critical flaws as part of its August 2026 update:
CVE-2026-44772 (CVSS: 9.9) – Code Injection in Manufacturing Integration
This vulnerability affects Manufacturing Integration and Intelligence. It allows a low-privileged attacker to submit specially crafted input.
Key points:
- The input causes the application to fetch attacker-controlled content
- Content is fetched from an external source
- Leads to arbitrary command execution on the underlying host
Mitigation:
- Apply the patch
- Maintain the new system property "Secure Transformer"
- List of allowed hosts for XSL files must be configured
- Only XSL files from these hosts can be consumed
CVE-2026-34265 (CVSS: 9.8) – DIAG Protocol Memory Corruption
This affects Application Server ABAP for SAP NetWeaver and ABAP Platform.
Key points:
- Out-of-bounds write vulnerability
- Unauthenticated attacker can exploit logical errors
- DIAG protocol parsing is vulnerable
- Results in memory corruption
- Can disclose sensitive system information
- Can crash the system
CVE-2026-44758 (CVSS: 9.1) – Code Injection in Manufacturing Integration
This affects Manufacturing Integration and Intelligence. It permits high-privilege users to execute arbitrary commands.
Key points:
- Vulnerable component of the servlet
- Vulnerable to server-side template injection (SSTI)
- Vulnerable to server-side request forgery (SSRF)
- Causes command execution
Mitigation:
- Apply the patch
- The vulnerable servlet component is removed
Vulnerability Details
CVE-2026-44772 Details:
- Affects Manufacturing Integration and Intelligence
- Low-privileged attacker can exploit
- Specially crafted input triggers the vulnerability
- Application fetches attacker-controlled content
- Arbitrary command execution on the host
Post-Patch Requirements:
- Maintain "Secure Transformer" system property
- Configure allowed hosts for XSL files
- Only trusted hosts can be used
CVE-2026-44758 Details:
- Affects Manufacturing Integration and Intelligence
- High-privileged attacker required
- Vulnerable servlet component
- SSTI and SSRF vulnerabilities
- Command execution on the host
What We Don't Know
- SAP has not disclosed specific details about:
- Whether the vulnerability has been exploited in the wild
- The identity of any attackers
- Which organizations may have been targeted
Wrapping It Up
The SAP Commerce Cloud vulnerability is a maximum-severity flaw that allows unauthenticated attackers to execute arbitrary code. CVE-2026-58231 carries a CVSS score of 10.0.
Key points to remember:
- Affects SAP Commerce Cloud (Data Hub Adapter)
- Unauthenticated attackers can abuse default authentication
- Insufficient validation leads to code execution
- Patch immediately or configure IP filters
- Three other critical flaws were also patched
Organizations should patch immediately. If patching is not an option, implement IP filtering as a temporary measure. Check for other critical vulnerabilities and make sure you patch those too.
SAP Commerce Cloud is just another example of enterprise applications which have critical vulnerabilities. Patching is very important in such cases.
FAQ Section
What is the SAP Commerce Cloud vulnerability?
CVE-2026-58231 is a maximum-severity flaw that allows unauthenticated attackers to execute arbitrary code on SAP Commerce Cloud systems. Vulnerability is caused by invalidation of input data and authorization checks.
How does the vulnerability work?
The attacker misuses a default authentication client by providing specific input to some functions that have no proper input validation and result in code execution.
What is the CVSS score?
The CVSS score in this case is 10.0, the maximum score available. The CVSS score is related to confidentiality, integrity, and availability.
What can be done by organizations?
Apply the patch immediately and implement the updated version of Commerce Cloud. Another way would be the implementation of IP filters for the affected endpoint.
What else was fixed?
CVE-2026-44772 (code injection), CVE-2026-34265 (DIAG protocol memory corruption), and CVE-2026-44758 (code injection) were also fixed by SAP.
