Full research report
Max severity SAP Commerce Cloud flaw now targeted in attacks
Executive assessment
CVE-2026-58231 is a well-evidenced CVSS 10.0 flaw in SAP Commerce Cloud's Data Hub Adapter, confirmed by NVD, Onapsis, and multiple independent outlets, with fixed versions 2211.55 and 2211-jdk21.17 available via SAP Note 3771065 since August 12, 2026. The exploitation claim rests on a single vendor's honeypot telemetry (Defused, August 14), and is not yet corroborated by CISA's KEV catalogue or any government body — NVD's CISA-ADP SSVC annotation, published before Defused's report, still shows exploitation as 'None'. The flaw's CVSS vector — unauthenticated, no complexity, scope change, full CIA impact — makes it a credible and high-priority target given the 4,200+ internet-facing Commerce Cloud instances Shadowserver tracks. SAP Commerce Cloud's repeated authentication-boundary weaknesses across 2026 (CVE-2026-44761, CVE-2026-22732, CVE-2026-34263) reinforce that defenders should treat this platform's authentication surface as systematically under-hardened. Patching and Data Hub Adapter access restriction are the only confirmed mitigations; no actor attribution or malware family has been associated with the observed exploitation attempts.
What happened
SAP released its August 2026 Security Patch Day on August 12, 2026, including SAP Note 3771065 addressing CVE-2026-58231, a CVSS 10.0 unauthenticated remote code execution flaw in the Data Hub Adapter extension of SAP Commerce Cloud (versions 2211 and 2211-JDK21). Three days later, on August 14, 2026, threat intelligence company Defused reported that exploitation attempts against the vulnerability had been detected on their honeypot infrastructure, despite the absence of any public proof-of-concept. SAP confirmed it is aware of and investigating the exploitation report, and recommends customers patch with immediate effect. As of August 15, 2026, CISA has not added CVE-2026-58231 to its Known Exploited Vulnerabilities catalogue, and NVD's CISA-ADP annotation — published before the Defused report — assessed exploitation status as 'None'.
Affected scope
SAP Commerce Cloud (formerly SAP Hybris) versions COM_CLOUD 2211 and 2211-JDK21, specifically the Data Hub Adapter extension. The platform is used by large global retailers and major brands. Shadowserver tracks over 4,200 internet-exposed IP addresses with a SAP Commerce Cloud fingerprint, concentrated in Europe and North America; the number of those that remain unpatched is unknown.
Technical assessment
The flaw (CWE-94: Improper Control of Code Generation) exists in the Data Hub Adapter extension and arises from a default authentication client that accepts requests without enforcing proper authorisation, combined with insufficient input validation in downstream functions. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects that the attack is network-delivered with no complexity, no credentials, no user interaction required, and achieves scope change — meaning a successful attacker can affect components beyond the initial target service. No public proof-of-concept has been published, yet exploitation probing was observed within three days of patching, indicating either independent discovery by threat actors or pre-patch reconnaissance. SAP Commerce Cloud's recent vulnerability history — CVE-2026-44761 (OAuth2 sample credential retention), CVE-2026-22732 (Spring Security misconfiguration), and CVE-2026-34263 (missing authentication check) — indicates a recurring pattern of authentication boundary weaknesses in the platform.
Recommended defensive actions
- Patch immediately to SAP Commerce Cloud 2211.55 or 2211-jdk21.17 by applying SAP Note 3771065 and rebuilding and redeploying the updated instance.
- Configure an IP Filter Set in SAP Commerce Cloud to restrict access to the Data Hub Adapter endpoint as an interim control if patching cannot be completed immediately.
- Audit your internet-facing SAP Commerce Cloud deployments and cross-reference against Shadowserver's fingerprint inventory to confirm exposure.
- Hunt for exploitation indicators in pre-patch application logs, focusing on unexpected or anomalous unauthenticated requests to Data Hub Adapter endpoints.
- Monitor CISA's KEV catalogue and SAP's security advisory channels for confirmed exploitation status updates that may trigger mandatory remediation timelines.
Uncertainties and evidence gaps
- The exploitation claim rests solely on Defused honeypot telemetry; it has not been independently corroborated by CISA, CERT organisations, or a second threat intelligence vendor.
- NVD's CISA-ADP SSVC annotation assessed exploitation as 'None' — this was published before the Defused report and may not yet reflect the August 14 honeypot data.
- The number of the 4,200+ Shadowserver-fingerprinted SAP Commerce Cloud instances that remain unpatched and genuinely vulnerable is unknown.
- The identity, objectives, and tooling of the actors probing honeypots have not been disclosed; it is unclear whether this is opportunistic scanning or targeted activity against specific sectors.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Honeypot-based exploitation attempts against CVE-2026-58231 were detected by Defused three days after SAP's August 12 patch release; no public proof-of-concept is available and CISA has not yet added this CVE to its Known Exploited Vulnerabilities catalogue.
Investigation began with the BleepingComputer source article claiming active honeypot-detected exploitation of CVE-2026-58231 three days after patching. NVD confirmed the CVSS 10.0 rating and technical classification (CWE-94) but its CISA-ADP annotation — predating the Defused report — assessed exploitation as 'None', creating a material evidence discrepancy. Onapsis provided independent corroboration of patch specifics including fixed version numbers. Searches confirmed prior Commerce Cloud CVEs (CVE-2026-44761, CVE-2026-22732, CVE-2026-34263) are real but addressed in earlier patch cycles. No CISA KEV addition was found as of August 15, and no public proof-of-concept was identified, resulting in medium confidence.
- Does the source article support the claimed exploitation timeline and technical details?Fetched the BleepingComputer articlebleepingcomputer.com ↗
Article confirms CVE-2026-58231 (CVSS 10.0), Data Hub Adapter vulnerability, SAP Note 3771065, Defused honeypot detection on August 14 three days post-patch, 4,200+ Shadowserver-fingerprinted instances, no public PoC, and a SAP statement confirming awareness and investigation.
why Established the primary event timeline and identified claims requiring independent verification.
- What do authoritative sources say about CVE-2026-58231's technical details and exploitation status?Fetched NVD entry for CVE-2026-58231nvd.nist.gov ↗
NVD confirms CVSS v3.1 10.0, CWE-94, affected versions COM_CLOUD 2211 and 2211-JDK21, published August 11 2026, SAP Note 3771065 as remediation reference. CISA-ADP SSVC annotation rates current exploitation as 'None' — this assessment predates the August 14 Defused report.
why NVD is a primary US government authority; the 'None' exploitation rating conflicts with the Defused honeypot claim and must be explicitly flagged in the uncertainty section.
- Does an independent SAP security specialist corroborate patch specifics and affected versions?Fetched Onapsis SAP Patch Day August 2026 blogonapsis.com ↗
Onapsis confirms SAP Note 3771065, CVSS 10.0, and provides specific fixed versions — 2211.55 and 2211-jdk21.17 — not published in the source article. Confirms IP Filter Set as a temporary workaround. Other Commerce Cloud CVEs in the blog differ from those stated in the article brief.
why Onapsis is a recognised SAP security authority; their fixed version numbers and workaround details add actionable precision for defenders.
- Are the three related CVEs (CVE-2026-44761, CVE-2026-22732, CVE-2026-34263) confirmed as genuine prior Commerce Cloud vulnerabilities?Searched for the three CVEs and fetched The Hacker News article covering the August 2026 patch daythehackernews.com ↗
CVE-2026-44761 (OAuth2 sample credential retention, CVSS 9.1) and CVE-2026-22732 (Spring Security misconfiguration, CVSS 9.1) and CVE-2026-34263 (missing authentication check enabling code execution) are confirmed as real Commerce Cloud vulnerabilities patched in May/June/July 2026 — not August.
why Establishing prior vulnerability context is relevant for defenders assessing the platform's cumulative authentication weakness pattern and for understanding the scope of the article's CVE list.
- Does a government advisory independently corroborate any of the CVEs?Fetched Singapore CSA advisory AL-2026-075csa.gov.sg ↗
The advisory covers a June 2026 batch of SAP vulnerabilities including CVE-2026-22732 (CVSS 9.1, Spring Security misconfiguration in Commerce Cloud) alongside SAP NetWeaver flaws. It does not cover CVE-2026-58231.
why Provides independent government-level corroboration that CVE-2026-22732 is a real prior Commerce Cloud vulnerability but adds no new evidence on the August 14 exploitation claim.
- Has CISA added CVE-2026-58231 to its Known Exploited Vulnerabilities catalogue?Searched CISA KEV catalogue for CVE-2026-58231
No CISA KEV addition found for CVE-2026-58231 as of August 15, 2026. CISA KEV additions from July 2026 reference other vulnerabilities.
why Absence from KEV means there is no US government corroboration of confirmed in-the-wild exploitation; this, combined with the NVD 'None' SSVC rating, limits confidence in the exploitation claim to medium.
Research coverage
All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok8 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1665 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5324 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok683 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1009 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 7 opened outside the registered collection
Vendor & gov advisories3
Primary authority: confirms CVSS 10.0, CWE-94, affected versions COM_CLOUD 2211/2211-JDK21, references SAP Note 3771065; CISA-ADP SSVC annotation rates exploitation as 'None' as of NVD publication.
SAP security specialist analysis confirming Note 3771065, fixed versions 2211.55 and 2211-jdk21.17, and IP Filter Set workaround.
Independent government advisory covering prior Commerce Cloud flaw CVE-2026-22732 (CVSS 9.1, Spring Security misconfiguration); does not cover CVE-2026-58231.
Analysis & research3
Source article; includes SAP statement confirming awareness and investigation, Defused honeypot claim, and Shadowserver 4,200-instance count.
Independent technical corroboration of CVE-2026-58231 mechanism and confirmation of related Commerce Cloud vulnerabilities patched in prior cycles.
Confirms CWE-94 classification, affected version set (2211 and 2211-JDK21), and CVSS vector; also cross-references CVE-2026-44761 as a related vulnerability.