2026-08-12 · view entry permalink →
CVE-2026-58231 — SAP Commerce Cloud: an unauthenticated request to the Data Hub Adapter import endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy
SAP's August 2026 Security Patch Day of 2026-08-11 released 28 new security notes plus one GitHub security advisory, with two updates to previously released notes (SAP SE, 2026-08-11); Onapsis, counting the cycle its own way, puts it at thirty-three notes including five HotNews and nine High Priority (Onapsis Research Labs, 2026-08-11). The one that changes an exposure picture rather than a patch schedule is CVE-2026-58231, carried by SAP Security Note 3771065 at CVSS 10.0: an improper-authorization flaw in the Data Hub Adapter of SAP Commerce Cloud. Onapsis, which worked with SAP on eleven of the notes in this cycle, describes the cause as insufficient authorization checks combined with insufficient input validation, and the outcome as arbitrary code execution with compromise of internal components (Onapsis Research Labs, 2026-08-11). The reason this ranks above a routine critical: Commerce Cloud is the platform behind public storefronts, so the vulnerable component sits on the internet side of the estate by design, and the score's pre-auth, no-interaction profile means reaching it takes a crafted request rather than a foothold.
Remediation for this one is not a patch install. Onapsis states customers must patch to the fixed Commerce Cloud release levels referenced in the note and then rebuild and redeploy the updated version, and that the interim exposure reduction available today is an IP filter set restricting access to the vulnerable endpoint (Onapsis Research Labs, 2026-08-11). Any organisation whose change process treats "SAP note applied" as equivalent to "fixed" will record this as remediated while the storefront is still reachable. The same rebuild-and-redeploy requirement applies to CVE-2026-42945 (CVSS 8.1), a buffer overflow affecting Commerce Cloud public-cloud deployments fronted by NGINX, per SAP Security Note 3773203 (SAP SE, 2026-08-11).
Three further notes Onapsis classes as HotNews matter to different estates. CVE-2026-44772 (CVSS 9.9, Note 3765948) and CVE-2026-44758 (CVSS 9.1, Note 3758900) are code-injection flaws in SAP Manufacturing Integration and Intelligence reaching arbitrary command execution on the underlying host; Onapsis states the lower score on the second reflects a higher privilege requirement, and that the fix removes the vulnerable servlet component in both cases rather than hardening it (Onapsis Research Labs, 2026-08-11). CVE-2026-34265 (CVSS 9.8, Note 3714806) is the one to weigh against internal network exposure rather than internet exposure: "Logical errors in DIAG protocol parsing allow an unauthenticated attacker to generate memory corruptions" in the Application Server ABAP kernel, with potential disclosure of sensitive system information or a crash of the instance (Onapsis Research Labs, 2026-08-11). DIAG is the SAP GUI presentation protocol, so the affected listener is one that ordinarily faces user workstations, and the affected kernel list spans KRNL64NUC/KRNL64UC and KERNEL builds from 7.22 through 9.19 (SAP SE, 2026-08-11). Rounding out the High Priority set, CVE-2026-58243 (CVSS 8.8, Note 3772411) covers the SQL Console in SAP ABAP Developer Tools, where support for host expressions inside SQL statements let a low-privileged authenticated user run database operations they should not reach.
No party reports exploitation of any of these. That is the reason none of them carries a critical priority here — but the Data Hub Adapter flaw still demands action ahead of the normal SAP patch cadence, because its own mechanics set the clock: an unauthenticated, no-interaction path to code execution on a component that is internet-facing by product design, disclosed with a CVSS 10.0 and a documented interim network control, is the shape that gets scanned for within days of a patch day. Detection concepts are ordinary but specific: in web and reverse-proxy access logs, surface requests to the Data Hub import path from source addresses outside the integration ranges that legitimately feed it, and treat any such request that precedes an unexplained child process under the Commerce Cloud application account as an incident rather than an anomaly. Discriminating benign from malicious here is easier than usual — legitimate Data Hub imports arrive from a small, enumerable set of integration sources, so the source address and the calling identity, not the request body, are the useful filter. On the ABAP side, a DIAG-parsing memory-corruption attempt surfaces as work-process crashes or short dumps clustered on one instance rather than as an authentication event.
Logical errors in DIAG protocol parsing allow an unauthenticated attacker to generate memory corruptions.
As a temporary workaround, customers can reduce their exposure by configuring an IP Filter Set in SAP Commerce Cloud to restrict access to the vulnerable endpoint.