[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXfJbwDL2t52gsvc9fNz7RBj3Urx0liB3Q-fMGNIU1ig":3,"$fMReDBIRCygG4p58J0fJaJawgl2FlQDrjnjO5EPZ555w":33},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":14,"hero_image_url":15,"structured":16,"story_type":29,"created_at":30,"updated_at":31,"published_at":32},"active-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago","Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago","Threat intelligence firm Defused says unauthenticated code execution flaw in Data Hub Adapter is hitting honeypots, with thousands of instances exposed online","A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.",[10,11,12,13],"SAP","Commerce Cloud","RCE","Retail","# Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago\n\n*Threat intelligence firm Defused says unauthenticated code execution flaw in Data Hub Adapter is hitting honeypots, with thousands of instances exposed online*\n\n**Tags:** `SAP` `Commerce Cloud` `RCE` `Retail`\n\n> A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.\n\n---\n\nA maximum-severity remote code execution flaw in SAP Commerce Cloud is being probed by attackers only days after SAP released a fix, threat intelligence firm Defused said on Friday.\n\nThe vulnerability affects the Data Hub Adapter extension for Commerce Cloud, formerly SAP Hybris, a cloud-based e-commerce platform used by online stores of large global brands and retailers. SAP described the issue as an improper authorization weakness that lets an unauthenticated attacker abuse a default authentication client and supply specially crafted input to functions lacking sufficient validation. Successful exploitation could allow arbitrary code execution and compromise internal components.\n\n## What happened\nDefused researchers said first exploitation attempts against the flaw began hitting their honeypots three days after patch day. The firm noted at the time of reporting that no public proof-of-concept existed and the issue was not previously known to be exploited. SAP had not yet marked the flaw as actively exploited in the security advisory issued on Tuesday.\n\nThe issue is tracked as CVE-2026-58231 with a CVSS score of 10.0. Defused characterized the attack as low-complexity and achievable without privileges.\n\n## Who is affected\nCommerce Cloud customers running the Data Hub Adapter extension are in scope. The platform underpins online storefronts for high-profile global brands and large retailers. Internet scanning data cited by reporting shows more than 4,200 IP addresses with a SAP Commerce Cloud fingerprint exposed online, concentrated in Europe and North America, though the number of honeypots versus production systems and the patch status of those systems is unknown.\n\n## Technical detail\nSAP attributes the root cause to improper authorization in the core Data Hub Adapter extension. The vendor warns that exploitation could result in high impact on confidentiality, integrity and availability of the application.\n\n## What to do\nSAP released a fix in its Tuesday security update. Security teams are urged to apply the patch immediately, review web logs for unauthenticated requests targeting Data Hub Adapter endpoints, and restrict external access to Commerce Cloud administrative interfaces where possible. Monitoring for exploitation attempts is recommended given the rapid appearance of in-the-wild activity after disclosure.\n\n## Further reading & sources\n\n- [Max severity SAP Commerce Cloud flaw now targeted in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmax-severity-sap-commerce-cloud-flaw-now-targeted-in-attacks) — BleepingComputer\n","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Factive-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago.png?v=1fb0e11c19",{"cves":17,"technologies":27},[18],{"id":19,"kev":20,"poc":20,"url":21,"cvss":22,"epss":23,"risk_band":24,"risk_score":25,"cvss_version":26},"CVE-2026-58231",false,"\u002Fvulnerabilities\u002FCVE-2026-58231",10,0.0086,"Medium",54.93,"3.1",[28],{"vendor":10,"product":11},"exploitation","2026-08-14T15:55:48.267776+00:00","2026-10-16T12:29:31.354101+00:00",null,{"articles":34},[35,46,57,70],{"slug":36,"title":37,"summary":38,"tags":39,"hero_image_url":44,"story_type":29,"created_at":45},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.",[40,41,12,42,43],"Zimbra","CVE-2026-73570","CISA KEV","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","2026-09-24T07:12:41.74195+00:00",{"slug":47,"title":48,"summary":49,"tags":50,"hero_image_url":54,"story_type":55,"created_at":56},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-Able N-Central RCE with 3-day federal deadline","CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.",[51,52,42,12,53],"CVE-2026-18556","N-Able N-Central","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","vulnerability_disclosure","2026-09-21T12:03:34.769619+00:00",{"slug":58,"title":59,"summary":60,"tags":61,"hero_image_url":67,"story_type":68,"created_at":69},"greynoise-labs-reveals-34k-sessions-scanning-ivanti-connect-secure-for-cve-2025-","GreyNoise Labs reveals 34k+ sessions scanning Ivanti Connect Secure for CVE-2025-0282","Two parallel reconnaissance campaigns are scanning internet-facing Ivanti Connect Secure instances for CVE-2025-0282, with the high-volume cluster concentrated in AS213790 (Limited Network LTD) and the second campaign distributed across ~6,000 unique IPs.",[62,63,64,65,66,12],"Ivanti Connect Secure","CVE-2025-0282","GreyNoise Labs","AS213790","Limited Network LTD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgreynoise-labs-reveals-34k-sessions-scanning-ivanti-connect-secure-for-cve-2025-.png?v=ea7577722f","campaign","2026-09-14T07:09:53.792428+00:00",{"slug":71,"title":72,"summary":73,"tags":74,"hero_image_url":80,"story_type":55,"created_at":81},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004: Unauthenticated Attackers Execute Shell Commands via diffpatch","Gitea disclosed CVE-2026-60004, a critical remote code execution vulnerability in the diffpatch feature that allows unauthenticated remote attackers to write malicious Git hooks and execute arbitrary shell commands as the Gitea process user on default installations with open self-registration enabled.",[75,76,12,77,78,79],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00"]