Hackers started exploiting a critical vulnerability in SAP Commerce Cloud just three days after its public disclosure, according to threat intelligence organizations.
The vulnerability is tracked as CVE-2026-58231 and is described as an issue involving insufficient authorization checks and input validation.
An attacker can exploit the vulnerability, which has a CVSS score of 10, to execute arbitrary code and compromise internal components.
SAP announced patches for CVE-2026-58231 on August 11 and Defused reported that its honeypots had started seeing exploitation attempts on August 14. The security firm noted that there had been no public PoC exploit and no prior reports of in-the-wild exploitation.
KEVIntel, which uses proprietary sensors and private honeypots to observe exploitation attempts, independently confirmed seeing attacks.
The organization noted on August 15 that a PoC exploit has become available.
CISA’s Known Exploited Vulnerabilities (KEV) catalog currently includes 14 SAP product flaws, but only one of them, CVE-2019-0344, affects Commerce Cloud. The security hole was added to the KEV list in 2024.
CISA has yet to add CVE-2026-58231 to its catalog.
Related: Adobe Commerce Bug Targeted Immediately After Disclosure
Related: Fortune 500 Companies Hit in Azure Data Theft Campaign
Related: Critical Flaws Discovered in Belgian eID Software Used by 2 Million People
Related: Hackers Exploiting Unpatched GeoServer Zero-Day
