SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

Summary: SAP released patches for CVE-2026-58231, a maximum-severity flaw rated 10.0 on CVSS in Commerce Cloud's Data Hub Adapter, described as insufficient authorization checks and input validation that lets an unauthenticated attacker abuse a default authentication client and submit crafted input. Onapsis urged customers to patch to a fixed Commerce Cloud release and re-deploy, with an IP Filter Set restricting access to the vulnerable endpoint as a temporary workaround, and SAP also addressed three other critical flaws in its August 2026 update, including CVE-2026-44758 (SSTI and SSRF in a servlet component, which the patch removes) and CVE-2026-44772 (a servlet flaw enabling arbitrary command execution, requiring the new 'Secure Transformer' system property listing allowed XSL hosts).
Why it matters: A 10.0 flaw that an unauthenticated attacker can reach through a default authentication client means exposure exists before anyone logs in, and Onapsis notes that patching alone is not the full step: the updated Commerce Cloud version must be re-deployed.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-44758 CVE-2026-44772 CVE-2026-58231
Related: ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More Cyber Risks ·
SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026