SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch
Summary: SAP Commerce Cloud carries CVE-2026-58231, a maximum-severity flaw rated 10.0 on CVSS that stems from insufficient authorization checks and input validation, letting an unauthenticated attacker abuse a default authentication client and submit crafted input for possible arbitrary code execution. Defused Cyber's honeypots saw exploitation attempts three days after the patch released, and KEVIntel reported two attempts on August 14 from a single U.S.-based IP address.
Key Takeaway: A 10.0 unauthenticated flaw drew exploitation attempts within three days of its fix, and prior SAP flaws such as CVE-2025-31324 were weaponized by China-nexus clusters UNC5221, UNC5174 and CL-STA-0048 alongside ransomware groups BianLian and RansomExx.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Mentions
- CVE-2025-31324CVE-2026-58231
- Related
- Understanding the challenges of securing an NGO Cyber Risks ·Threat Brief: CVE-2025-31324 (Updated June 25) Cyber Risks ·CVE-2025-31324: SAP Net Weaver Unrestricted File Upload Vulnerability Known Exploited Vulnerabilities · Apr 29, 2025