Skip to content
OriginalConnect AISign inSign up free
Image: SecurityWeek

SecurityWeekEduard Kovacs

SAP Commerce Cloud flaw lets attackers run code after patch delay

Part of the CVE-2026-58231 story · since 11 Aug

Quiet for 13 weekslast report 17 Aug5 articles3 outlets
11 Aug · SecurityWeek first1 Oct18 OctNowThis article5th of 5
  • Tue 11 Aug, 14:51 UTC. SecurityWeek, first report. SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities.
  • Tue 11 Aug, 14:52 UTC. SecurityOnline, its first report on the story. SAP patches critical CVE-2026-58231 in Commerce Cloud, 28 notes.
  • Sat 15 Aug, 17:40 UTC. Security Affairs, its first report on the story. SAP Commerce Cloud CVE-2026-58231 Exploited in the Wild.
  • Sun 16 Aug, 09:49 UTC. Security Affairs. Hackers Leverage Expired Domains for Malware, SAP, macOS Exploits.
  • Mon 17 Aug, 08:21 UTC. SecurityWeek. SAP Commerce Cloud flaw lets attackers run code after patch delay. This article, 5th of 5.

Hackers are exploiting a critical vulnerability in SAP Commerce Cloud (CVE-2026-58231), identified shortly after its public disclosure. This vulnerability, which has a CVSS score of 10 due to insufficient authorization checks, enables arbitrary code execution. Patches were released on August 11, but by August 14, reports of exploitation attempts were confirmed by various threat intelligence organizations.

This security flaw is yet to be included in CISA's Known Exploited Vulnerabilities catalog, which lists 14 SAP product flaws, with only one impacting Commerce Cloud (CVE-2019-0344). An available proof-of-concept exploit may further increase the risk of exploitation.

How the story developed

All 5 articles
Quiet for 13 weekslast report 17 Aug5 articles3 outlets

5 articles from 3 outlets since 11 Aug. Quiet since 17 Aug. This was the 5th report, 6 days after the first.

Now11 Aug12131415161718First reportSecurityWeek · 11 Aug, 14:51This article5th of 5 · day 6Picked up againafter 4 days quiet
  • Tue 11 Aug, 14:51 UTC. SecurityWeek, first report. SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities.
  • Tue 11 Aug, 14:52 UTC. SecurityOnline, its first report on the story. SAP patches critical CVE-2026-58231 in Commerce Cloud, 28 notes.
  • Sat 15 Aug, 17:40 UTC. Security Affairs, its first report on the story. SAP Commerce Cloud CVE-2026-58231 Exploited in the Wild.
  • Sun 16 Aug, 09:49 UTC. Security Affairs. Hackers Leverage Expired Domains for Malware, SAP, macOS Exploits.
  • Mon 17 Aug, 08:21 UTC. SecurityWeek. SAP Commerce Cloud flaw lets attackers run code after patch delay. This article, 5th of 5.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Tue 11 AugDay 02
    1. SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities14:51 · SecurityWeek · First report
    2. SAP patches critical CVE-2026-58231 in Commerce Cloud, 28 notes14:52 · SecurityOnline

  2. Quiet for 4 days

    Sat 15 AugDay 41
    1. SAP Commerce Cloud CVE-2026-58231 Exploited in the Wild17:40 · Security Affairs · Picked up again
  3. Sun 16 AugDay 51
    1. Hackers Leverage Expired Domains for Malware, SAP, macOS Exploits09:49 · Security Affairs
  4. Mon 17 AugDay 61
    1. SAP Commerce Cloud flaw lets attackers run code after patch delay08:21 · SecurityWeek · This article, 5th of 5

Sources

CyberSIXTSignal over noise
Sign inSign up free

Updated