Attackers have begun targeting a maximum-severity SAP Commerce Cloud vulnerability just three days after a patch was released, according to threat intelligence firm Defused.
Commerce Cloud, formerly known as SAP Hybris, is a widely used cloud-based e-commerce platform that powers online storefronts for numerous high-profile global brands and large retailers.
The flaw, tracked as CVE-2026-58231, is an improper authorization weakness in the core Data Hub Adapter extension. It carries a CVSS score of 10.0 and can be exploited by unauthenticated attackers in low-complexity attacks to achieve arbitrary code execution.
According to SAP, the vulnerability allows an unauthenticated attacker to abuse a default authentication client and submit crafted input to functions that lack sufficient validation. Successful exploitation can lead to full compromise of internal components, with high impact on confidentiality, integrity, and availability.
SAP has not yet flagged the flaw as actively exploited in its own advisory, but Defused confirmed on Friday that exploitation attempts are already hitting its honeypots, despite there being no public proof-of-concept exploit available.
A SAP spokesperson confirmed the company is aware of and investigating the issue, pointing customers to security note 3771065, released as part of SAP’s August Patch Day, and urging immediate patching.
Wide exposure
Shadowserver is tracking more than 4,200 internet-facing IP addresses with a SAP Commerce Cloud fingerprint, concentrated mostly in Europe and North America. It remains unclear how many of these are honeypots or have already been patched against CVE-2026-58231.
Part of a broader pattern
This is far from SAP’s first critical Commerce Cloud issue this year. The July 2026 patch cycle fixed 16 vulnerabilities, while May and June combined addressed 30 more, including three additional critical flaws affecting the platform (CVE-2026-44761, CVE-2026-22732, and CVE-2026-34263). In April, researchers at Aikido and Socket also disclosed a supply chain attack involving compromised official SAP npm packages used to steal developer credentials.
Since November 2021, CISA has added 14 SAP vulnerabilities to its Known Exploited Vulnerabilities catalog, three of which were leveraged in ransomware attacks. SAP serves 99 of the world’s 100 largest companies and reported revenues exceeding 36 billion euros in fiscal year 2025, making its products a high-value target for threat actors.
Organizations running SAP Commerce Cloud should apply security note 3771065 immediately and review exposure of internet-facing instances.