CRITICAL CWE-94
CVE-2026-58231
Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
SAP·Commerce Cloud (Data Hub Adapter)
10.0/ 10
CVSS 3.1
Critical severity
0.86%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 59% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Aug 11, 2026
- Updated
- Aug 12, 2026
- First covered
- Aug 16, 2026
- Latest story
- 3 months ago
Summary
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.
CWE-94Improper Control of Generation of Code
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HAffected products
- SAP Commerce Cloud (Data Hub Adapter)COM_CLOUD 22112211-JDK21