A critical security vulnerability in SAP Commerce Cloud, identified as CVE-2026-58231, is under active attack just three days after the release of a security patch. This vulnerability, which holds a maximum severity CVSS score of 10.0, allows unauthenticated attackers to execute arbitrary code remotely, posing significant risks to enterprises using this platform. Despite the absence of a public proof of concept, hackers have started probing for weaknesses, with initial exploitation attempts tracked to infrastructure in the United States. The attacks were detected through defused honeypot telemetry, revealing inbound traffic aimed at exposed application endpoints. This suggests that attackers are systematically scanning SAP deployments to exploit this flaw.
SAP Commerce Cloud is widely used to support global digital storefronts and supply chain operations, making it a lucrative target for attackers. A successful breach could result in unauthorized access to backend databases and sensitive enterprise assets. The rapid attempts to exploit the vulnerability indicate that attackers may have reverse-engineered the patch to develop their attack methods.
Security teams are urged to prioritize the immediate application of the vendor's security update to all internet-facing and internal instances of SAP Commerce Cloud. For those unable to apply the patch right away, alternative protective measures should be implemented. This includes inspecting server logs for unusual POST requests and securing management interfaces behind virtual private networks. As enterprises often deal with lengthy patch testing cycles, there is an urgent need to act swiftly to protect their systems from unauthorized access and potential data breaches.