Home · Wiki · Vulnerabilities & CVEs

type: cve · created: 2026-08-16 · updated: 2026-08-16 · tags: [] · confidence: medium · severity: critical · affected_sectors: [retail, technology, finance] · au_impact: true

🎯 IOCs · BianLian

Indicators of compromise · BianLian — 4 shown

198[.]100[.]154[.]163:8443ip:port · ThreatFox · first seen 2026-10-11
162[.]243[.]6[.]201:9443ip:port · ThreatFox · first seen 2026-09-30
85[.]198[.]108[.]131:51227ip:port · ThreatFox · first seen 2026-09-28
122[.]51[.]212[.]92:39904ip:port · ThreatFox · first seen 2026-09-17

Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.

CVE-2026-58231 — SAP Commerce Cloud Pre-Auth RCE

Summary

CVE-2026-58231 is a maximum-severity (CVSS 10.0) unauthenticated arbitrary-code-execution vulnerability in SAP Commerce Cloud. An attacker abuses a default authentication client to submit specially crafted input to functions lacking sufficient validation, enabling arbitrary code execution without authentication.

Key Details

Vendor: SAP Commerce Cloud
CVSS: 10.0 (critical)
Type: Unauthenticated remote code execution (pre-auth RCE)
Vector: Abuse of a default authentication client + missing input validation
Exploitation: Attempts documented beginning ~3 days after SAP shipped its fix, per Onapsis vendor analysis and Defused Cyber honeypot telemetry
Public PoC: None published
Fix: Patch to fixed Commerce Cloud release levels and re-deploy; IP-Filter restrictions on the vulnerable endpoint as a temporary workaround

Timeline

2026-08: SAP ships patch
~3 days post-patch: Exploitation attempts observed in the wild (Onapsis / Defused Cyber)
2026-08-16: Covered in daily digest

Context

Prior SAP flaws (notably Cve 2025 31324 Sap Netweaver in NetWeaver) have been weaponised by both China-nexus espionage clusters (UNC5221, UNC5174) and cybercrime groups (BianLian, RansomExx). The rapid patch-to-exploitation conveyor mirrors the week's broader pattern — the macOS screen-sharing zero-day, SharePoint authentication bypass and Metabase SQLi all moved from advisory to active targeting within days.

Australian Relevance

A maximum-severity pre-auth RCE on an internet-facing commerce platform is exactly the class of vulnerability ACSC's Essential Eight targeting and patch-promptness guidance and the ASD Information Security Manual require local firms to remediate immediately. Treat public Cloud/Commerce deployments as high-priority attack surfaces.

Cve 2025 31324 Sap Netweaver — Prior SAP NetWeaver flaw weaponised by espionage and cybercrime groups
Critical Sap Commerce Cloud Vulnerability Targeted In Active Exploitation Attemp — The incident entry for this campaign