SAP Commerce Cloud flaw opens unauthenticated path to code execution

SAP has patched a CVSS 10.0 vulnerability in Commerce Cloud that could allow an unauthenticated attacker to execute arbitrary code. The flaw, tracked as CVE-2026-58231, affects the Data Hub Adapter and combines inadequate authorization controls with insufficient input validation.

The security issue is especially serious because exploitation does not require valid credentials. An attacker can abuse a default authentication client and send specially crafted input to affected functions, potentially turning an exposed application interface into a route for code execution.

CVE-2026-58231 can allow successful attackers to compromise internal components of the affected application. The reported impact covers confidentiality, integrity, and availability, meaning exploitation could potentially expose information, alter application behavior, or disrupt services.

From a defensive perspective, the lack of an authentication requirement is an important distinction. An attacker does not first have to steal an account or obtain elevated privileges before attempting to exploit the vulnerable functionality. SAP security firm Onapsis has recommended moving to a fixed Commerce Cloud release and redeploying the updated version. Customers that cannot immediately patch can use an IP Filter Set to restrict access to the vulnerable endpoint.

That restriction can reduce exposure, but it does not remove the application flaw. The patched release remains the primary remediation.

SAP's August 2026 security update addresses three additional critical vulnerabilities affecting its enterprise software portfolio.

CVE-2026-44772 has a CVSS score of 9.9 and affects Manufacturing Integration and Intelligence. A low-privileged attacker can submit specially crafted input that causes a vulnerable servlet to retrieve and process attacker-controlled content from an external source.

That behavior could ultimately lead to arbitrary command execution on the underlying host. SAP's fix adds a Secure Transformer system property that requires customers to specify approved hosts for XSL files.

CVE-2026-34265 carries a 9.8 rating and affects Application Server ABAP for SAP NetWeaver and ABAP Platform. An unauthenticated attacker can exploit logical errors in DIAG protocol parsing, causing memory corruption that could disclose sensitive system information or crash the system.

CVE-2026-44758 is rated 9.1 and also affects Manufacturing Integration and Intelligence. According to Onapsis, a vulnerable servlet component was susceptible to server-side template injection and server-side request forgery, creating a potential route to command execution. SAP's remediation removes that vulnerable servlet component.

The four vulnerabilities highlight different enterprise attack paths, including unauthenticated access, low-privilege exploitation, unsafe processing of external content, and memory corruption. For Commerce Cloud deployments, security teams should identify affected instances, apply the fixed release, and redeploy it. Teams using the temporary IP filtering measure should also review that restriction as part of the remediation process.

The immediate concern is exposure, not simply the CVSS number. A remotely reachable enterprise application with an unauthenticated path to arbitrary code execution warrants prompt attention, particularly where the affected system connects to sensitive internal services or business data.

Why mobile apps must defend themselves in real time

How AI cyber risk platforms change security operations in India

Windows BitLocker zero day raises fresh risks for encrypted drives

Copy Fail Linux flaw could turn a tiny kernel bug into root access