VULNpocalypse
CriticalVulnerabilityPatch available

SAP Commerce Cloud Data Hub Adapter CVE-2026-58231: CVSS 10 unauthenticated code execution, attacked days after the patch

A default authentication client in SAP Commerce Cloud’s Data Hub Adapter lets attackers run code without logging in. Deploy 2211.55 or 2211-jdk21.17 now.

Published
Updated
Fixed in
SAP Commerce Cloud 2211.55, 2211-jdk21.17 (SAP Security Note 3771065)
Exploitation
Attempts seen by Defused from 14 August 2026; reported as exploited by Belgium’s CCB (not verified by us); SAP had not confirmed; not in CISA KEV as of 30 October 2026

Live scores

CVE-2026-58231
EPSS
0.009
low predicted chance of attack
VEDAS
0.975
strong exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

What happened

On its August 2026 Patch Day (11 August), SAP released Security Note 3771065 for CVE-2026-58231, rated CVSS 10.0. SAP’s description: SAP Commerce Cloud “allows an unauthenticated attacker to abuse a default authentication client” and submit crafted input to functions that lack proper validation, which “could enable arbitrary code execution and compromise internal components” (CVE record). The flaw is in the Data Hub Adapter extension. Affected versions are COM_CLOUD 2211 and 2211-JDK21 (CVE record; Field Effect).

Attacks started three days later. On 14 August, Defused reported the first exploitation attempts against its honeypots. At that point there was no public proof of concept. SAP had not marked the flaw as exploited, and told BleepingComputer it was aware of the reports and investigating (BleepingComputer; Cloud Security Alliance). Belgium’s Centre for Cybersecurity (CCB) published a warning whose address names critical and actively exploited vulnerabilities in SAP Commerce Cloud and NetWeaver (CCB). The page refused our requests, so we could not confirm which CVE it lists as exploited. The CVE was not in CISA’s KEV catalog as of 30 October 2026 (CISA KEV).

Shadowserver saw more than 4,200 internet-reachable systems with a SAP Commerce Cloud fingerprint, mostly in Europe and North America. How many were vulnerable is unknown (Field Effect).

Am I affected?

You are affected if any environment runs SAP Commerce Cloud 2211 below 2211.55, or 2211-JDK21 below 2211-jdk21.17, with the Data Hub Adapter (Cloud Security Alliance; Field Effect).

  • Check the Commerce version of the build that is deployed in each environment in SAP Cloud Portal, not only the version in your repository. The Cloud Security Alliance notes that containerized and multi-environment setups need an explicit rebuild and redeploy before the fix reaches production.
  • Check whether your build includes the Data Hub Adapter extension (in manifest.json or localextensions.xml).

No indicators of compromise have been published in the sources we opened. The Cloud Security Alliance suggests reviewing logs for unexpected authentication with the default Data Hub Adapter client, unexpected process creation on Commerce hosts, and unusual outbound connections from them (Cloud Security Alliance).

What to do now

  1. Build and deploy 2211.55 or 2211-jdk21.17 or later to every environment (Field Effect). SAP asks customers to “patch their systems with immediate effect” (BleepingComputer).
  2. Until then, restrict the Data Hub Adapter import endpoint with an IP Filter Set that allows only your trusted Data Hub systems. SAP and Onapsis describe this as a temporary control, not a fix (Cloud Security Alliance; Field Effect).
  3. Hunt from 11 August onward on any environment that was unpatched and reachable: default-client authentications, new processes and outbound connections from Commerce nodes.
  4. If you find signs of code execution, review what the Commerce environment can reach. The Cloud Security Alliance points to the ERP, CRM, payment and fulfilment systems it is integrated with, and the service accounts it uses for them (Cloud Security Alliance).

Sources