Critical SAP Commerce Cloud Vulnerability Targeted in Exploitation Attempts

Summary

CVE-2026-58231 (CVSS 10.0), an unauthenticated arbitrary-code-execution vulnerability in SAP Commerce Cloud, drew exploitation attempts in the wild within days of SAP's patch. Vendor analysis from Onapsis and honeypot telemetry from Defused Cyber indicate attempts began as little as three days after the fix shipped.

Key Details

• Date: 2026-08-15
• Source: The Hacker News
• Reliability: Tier 2/4 — Established cyber journalism
• Type: Pre-auth RCE (Cve 2026 58231 Sap Commerce Cloud Rce, CVSS 10.0)
• Status: Reported — vendor honeypot telemetry and analysis; no government confirmation of victim compromise
• Public PoC: None
• Actors: Prior SAP flaws (Cve 2025 31324 Sap Netweaver) weaponised by China-nexus espionage (UNC5221, UNC5174) and cybercrime (BianLian, RansomExx)

Analysis

Exploitation attempts starting within ~3 days of patch confirm the week's dominant pattern: adversaries sweeping for internet-facing, immediately-reachable, under-patched commerce and remote-access surfaces. The lack of a confirmed victim compromise is notable — this is vendor telemetry of attempted exploitation rather than a documented breach.

Related

• Cve 2026 58231 Sap Commerce Cloud Rce — The underlying vulnerability
• Metabase Zero Day Exploited In Wild Allows Admin Access Without Authentication C — Another CVSS 10.0 exploited in the wild the same week