SAP Commerce Cloud CVE-2026-58231 Exploited in the Wild Days After Patch

A maximum-severity vulnerability in SAP Commerce Cloud, tracked as CVE-2026-58231, is now being actively exploited in the wild, just days after SAP released a patch. The flaw, rated 10.0 on the CVSS scale, stems from insufficient authorization checks and input validation.

According to CVE.org, an unauthenticated attacker can abuse a default authentication client to submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could lead to arbitrary code execution and compromise internal components, with high impact on confidentiality, integrity, and availability.

Threat intelligence firm Defused Cyber reported that exploitation attempts against CVE-2026-58231 hit its honeypot systems only three days after the patch was released. The company noted that there is no public proof-of-concept and the vulnerability was not previously known to be exploited.

SAP security company Onapsis emphasized that customers must patch to the fixed Commerce Cloud release levels referenced in the SAP security note and re-build/re-deploy the updated version. As a temporary workaround, Onapsis recommends configuring an IP Filter Set in SAP Commerce Cloud to restrict access to the vulnerable endpoint.

While the identity of the attackers remains unknown, the article highlights that prior SAP flaws, such as CVE-2025-31324 affecting SAP NetWeaver, have been exploited by China-nexus espionage clusters like UNC5221, UNC5174, and CL-STA-0048, as well as cybercrime groups such as BianLian and RansomExx. In April 2025, unknown actors exploited that same NetWeaver vulnerability to deploy a backdoor called Auto-Color in an attack on a U.S.-based chemicals company.

Organizations using SAP Commerce Cloud should urgently apply the latest patches and monitor for indicators of compromise.