A maximum-severity remote code execution flaw in SAP Commerce Cloud is being probed by attackers only days after SAP released a fix, threat intelligence firm Defused said on Friday.
The vulnerability affects the Data Hub Adapter extension for Commerce Cloud, formerly SAP Hybris, a cloud-based e-commerce platform used by online stores of large global brands and retailers. SAP described the issue as an improper authorization weakness that lets an unauthenticated attacker abuse a default authentication client and supply specially crafted input to functions lacking sufficient validation. Successful exploitation could allow arbitrary code execution and compromise internal components.
What happened
Defused researchers said first exploitation attempts against the flaw began hitting their honeypots three days after patch day. The firm noted at the time of reporting that no public proof-of-concept existed and the issue was not previously known to be exploited. SAP had not yet marked the flaw as actively exploited in the security advisory issued on Tuesday.
The issue is tracked as CVE-2026-58231 with a CVSS score of 10.0. Defused characterized the attack as low-complexity and achievable without privileges.
Who is affected
Commerce Cloud customers running the Data Hub Adapter extension are in scope. The platform underpins online storefronts for high-profile global brands and large retailers. Internet scanning data cited by reporting shows more than 4,200 IP addresses with a SAP Commerce Cloud fingerprint exposed online, concentrated in Europe and North America, though the number of honeypots versus production systems and the patch status of those systems is unknown.
Technical detail
SAP attributes the root cause to improper authorization in the core Data Hub Adapter extension. The vendor warns that exploitation could result in high impact on confidentiality, integrity and availability of the application.
What to do
SAP released a fix in its Tuesday security update. Security teams are urged to apply the patch immediately, review web logs for unauthenticated requests targeting Data Hub Adapter endpoints, and restrict external access to Commerce Cloud administrative interfaces where possible. Monitoring for exploitation attempts is recommended given the rapid appearance of in-the-wild activity after disclosure.
Further reading & sources
- Max severity SAP Commerce Cloud flaw now targeted in attacks — BleepingComputer