Skip to content
Connect AISign inSign up free
CVE-2026-5823110.0CriticalCWE-94

CVE-2026-58231: Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

SAP_SE · SAP Commerce Cloud (Data Hub Adapter)

No fix listed · Affected: SAP_SE SAP Commerce Cloud (Data Hub Adapter) · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub15 Aug
  5. Not established: not seen
0.9%probability of exploitation in the next 30 days
58th percentile
050100

Higher than 58% of scored CVEs

10.0CriticalCVSS 3.1
LowCrit.

DescriptionNVD

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas
Exploitation
Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV
Not listed
Public check
No public nuclei template
Weakness
Code Injection · Command and Code Injection
Vendor
SAP_SE
Published
August 2026
Band
Unlikely (under 1%), August 2026

What changed

  1. PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub

Coverage5 articles · 3 outlets

One row per outlet, in order of first report. First in our coverage: SecurityWeek, 11 Aug.

Full timeline
Quiet for 13 weekslast report 17 Aug5 articles3 outlets
11 Aug · SecurityWeek first1 Oct18 OctNow
  • Tue 11 Aug, 14:51 UTC. SecurityWeek, first report. SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities.
  • Tue 11 Aug, 14:52 UTC. SecurityOnline, its first report on the story. SAP patches critical CVE-2026-58231 in Commerce Cloud, 28 notes.
  • Sat 15 Aug, 17:40 UTC. Security Affairs, its first report on the story. SAP Commerce Cloud CVE-2026-58231 Exploited in the Wild.
  • Sun 16 Aug, 09:49 UTC. Security Affairs. Hackers Leverage Expired Domains for Malware, SAP, macOS Exploits.
  • Mon 17 Aug, 08:21 UTC. SecurityWeek. SAP Commerce Cloud flaw lets attackers run code after patch delay.
All coveragerunning total5SecurityWeek2SecurityOnl…1Security Af…212 Aug13 Sep15 OctNow
  • First report
  • Article
  • Running total
Show as table
5 articles about CVE-2026-58231 from 3 outlets
Published (UTC)OutletHeadline
11 Aug 14:51SecurityWeekSAP Patches Critical Code Injection, Memory Corruption Vulnerabilities
11 Aug 14:52SecurityOnlineSAP patches critical CVE-2026-58231 in Commerce Cloud, 28 notes
15 Aug 17:40Security AffairsSAP Commerce Cloud CVE-2026-58231 Exploited in the Wild
16 Aug 09:49Security AffairsHackers Leverage Expired Domains for Malware, SAP, macOS Exploits
17 Aug 08:21SecurityWeekSAP Commerce Cloud flaw lets attackers run code after patch delay
  1. SAP Commerce Cloud flaw lets attackers run code after patch delay
    SecurityWeek
  2. Hackers Leverage Expired Domains for Malware, SAP, macOS Exploits
    Security Affairs
  3. SAP Commerce Cloud CVE-2026-58231 Exploited in the Wild
    Security Affairs
  4. SAP patches critical CVE-2026-58231 in Commerce Cloud, 28 notes
    SecurityOnline
  5. SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities
    SecurityWeek · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Sign inSign up free

Updated