SAP Commerce Cloud CVE-2026-58231: an unauthenticated request to a vulnerable Data Hub Adapter endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy
SAP's August patch day is led by a CVSS 10.0 pre-auth code-execution flaw in the Commerce Cloud Data Hub Adapter, fixed only by a rebuild and redeploy
Defender actions
- Rebuild and redeploy the fixed release from SAP Security Note 3771065 on every self-managed SAP Commerce Cloud instance, since an installed patch is not sufficient for this component; restrict the vulnerable Data Hub Adapter endpoint with a Commerce Cloud IP filter set until the redeploy, and give any instance that stayed reachable and unredeployed after 2026-08-14 a compromise assessment.
- For any SAP Manufacturing Integration and Intelligence instance patched with Security Note 3765948 (CVE-2026-44772), configure and maintain the new 'Secure Transformer' system property with an explicit allowed-hosts list for XSL files: the patch alone does not remove the vulnerable servlet, and Onapsis requires the property after the patch so that only XSL files from the listed hosts can be consumed.
Analysis
SAP's August 2026 Security Patch Day of 2026-08-11 released 28 new security notes plus one GitHub security advisory, with two updates to previously released notes (SAP SE, 2026-08-11); Onapsis, counting the cycle its own way, puts it at thirty-three notes including five HotNews and nine High Priority (Onapsis Research Labs, 2026-08-11). The one that changes an exposure picture rather than a patch schedule is CVE-2026-58231, carried by SAP Security Note 3771065 at CVSS 10.0: an improper-authorization flaw in the Data Hub Adapter of SAP Commerce Cloud. Onapsis, which worked with SAP on eleven of the notes in this cycle, describes the cause as insufficient authorization checks combined with insufficient input validation, and the outcome as arbitrary code execution with compromise of internal components (Onapsis Research Labs, 2026-08-11). The reason this ranks above a routine critical: Commerce Cloud runs online stores, so in analyst judgement the vulnerable component is likely to be reachable from the internet, and the score's pre-auth, no-interaction profile means reaching it takes a crafted request rather than a foothold.
Remediation for this one is not a patch install. Onapsis states customers must patch to the fixed Commerce Cloud release levels referenced in the note and then rebuild and redeploy the updated version, and that the interim exposure reduction available today is an IP filter set restricting access to the vulnerable endpoint (Onapsis Research Labs, 2026-08-11). Any organisation whose change process treats "SAP note applied" as equivalent to "fixed" will record this as remediated while the storefront is still reachable. SAP Security Note 3773203 is SAP's fix for CVE-2026-42945 (CVSS 8.1) as a potential buffer overflow affecting Commerce Cloud public-cloud deployments with NGINX (SAP SE, 2026-08-11), and it is consumed the same way, by building and deploying the Commerce Cloud application (Onapsis, 2026-08-11).
Further notes Onapsis classes as HotNews matter to different estates. CVE-2026-44772 (CVSS 9.9, Note 3765948) and CVE-2026-44758 (CVSS 9.1, Note 3758900) are code-injection flaws in SAP Manufacturing Integration and Intelligence reaching arbitrary command execution on the underlying host; Onapsis states the lower score on the second reflects a higher privilege requirement. The two remedies are not the same: for Note 3758900 (CVE-2026-44758) the patch removes the vulnerable servlet component outright, while for Note 3765948 (CVE-2026-44772) the servlet stays in place and customers must additionally configure and maintain a new "Secure Transformer" system property naming the hosts allowed to serve XSL files to it (Onapsis Research Labs, 2026-08-11). CVE-2026-34265 (CVSS 9.8, Note 3714806) is, in analyst judgement, the one to weigh against internal network exposure rather than internet exposure. Onapsis describes it: "Logical errors in DIAG protocol parsing allow an unauthenticated attacker to generate memory corruptions" in the Application Server ABAP kernel, with potential disclosure of sensitive system information or a crash of the instance (Onapsis Research Labs, 2026-08-11). The affected kernel list spans KRNL64NUC/KRNL64UC and KERNEL builds from 7.22 through 9.19 (SAP SE, 2026-08-11); since DIAG is the SAP GUI presentation protocol, the affected listener is, in analyst judgement, one that ordinarily faces user workstations. Rounding out the High Priority set, CVE-2026-58243 (CVSS 8.8, Note 3772411) covers the SQL Console in SAP ABAP Developer Tools, where support for host expressions inside SQL statements let a low-privileged authenticated user run database operations they should not reach (Onapsis Research Labs, 2026-08-11).
On patch day NCSC-CH rated the exploitation status unknown (NCSC-CH, 2026-08-11); three days later Defused reported exploitation attempts against the Data Hub Adapter flaw at its honeypots (BleepingComputer, 2026-08-14), and on 2026-08-15 NCSC-NL relayed Defused's report of attackers actively scanning for vulnerable systems (NCSC-NL, 2026-08-15). The Data Hub Adapter flaw demands action ahead of the normal SAP patch cadence: it is an unauthenticated, no-interaction path to code execution, disclosed with a CVSS 10.0 and a documented interim network control.
Cited evidence
Logical errors in DIAG protocol parsing allow an unauthenticated attacker to generate memory corruptions.
As a temporary workaround, customers can reduce their exposure by configuring an IP Filter Set in SAP Commerce Cloud to restrict access to the vulnerable endpoint.
First exploitation attempts against CVE-2026-58231 (unauth RCE in SAP Commerce Cloud, CVSS 10.0) is now hitting our honeypots - 3 days after patch day,
Security firm Defused reports that malicious actors are actively scanning and searching for vulnerable Data Hub Adapter systems. (translated from Dutch)
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation
Updates4
The Commerce Cloud flaw, which carried no reported exploitation at the 2026-08-11 patch day, is being attacked. Threat-intelligence firm Defused reported on 2026-08-14 that the first exploitation attempts against CVE-2026-58231 were arriving at its honeypot sensors three days after SAP's 2026-08-11 patch day, and stated in the same report that the vulnerability has no public proof-of-concept (BleepingComputer, 2026-08-14). Those two facts together are the operationally interesting part: in analyst judgement, whoever is sending these requests developed exploitation attempts without published research to copy, on a three-day clock, against a component whose remediation is slower than a patch install. On 2026-08-15 the Dutch national cyber security centre published advisory NCSC-2026-0302, which records that attackers are actively scanning for and seeking out vulnerable Data Hub Adapter systems (NCSC-NL, 2026-08-15).
The mechanism is worth restating precisely because it shapes what an exposed request looks like: SAP describes the flaw as allowing an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to functions that lack sufficient validation, reaching arbitrary code execution (BleepingComputer, 2026-08-14). The exposure is real rather than theoretical: Shadowserver tracks over 4,200 IP addresses carrying a SAP Commerce Cloud fingerprint, most of them in Europe and North America, though the same reporting is explicit that it cannot say how many of those are honeypots or already remediated (BleepingComputer, 2026-08-14).
Calibrate the status honestly. What is confirmed is exploitation attempts against sensors (BleepingComputer, 2026-08-14) and scanning for vulnerable systems (NCSC-NL, 2026-08-15); no party reports a compromised production instance, and SAP has not flagged the flaw as exploited in its own advisory (BleepingComputer, 2026-08-14). That distinction matters for triage effort, not for patch priority: exploitation attempts appeared within days of a public fix on this component, and the remediation is a rebuild-and-redeploy cycle measured in change windows.
Detection, in vendor-neutral terms: in web-access and application logs for the Data Hub Adapter, look for unauthenticated requests to the adapter's functions that present the default authentication client rather than a customer-provisioned one, and, in analyst judgement, for adapter activity that no scheduled integration run accounts for. Pair that with egress review from the Commerce Cloud application tier, since arbitrary code execution there runs inside the storefront's own host. Hardening remains the vendor's own path: Onapsis, which works with SAP on its patch cycle, records that customers must patch to the fixed Commerce Cloud release levels referenced in the note and then re-build and re-deploy the updated version, and that configuring an IP Filter Set in Commerce Cloud to restrict access to the vulnerable endpoint is the temporary workaround that reduces exposure meanwhile (Onapsis, 2026-08-11).
The entry stated that SAP's fix "removes the vulnerable servlet component in both cases" for CVE-2026-44772 (Note 3765948) and CVE-2026-44758 (Note 3758900). Onapsis's own text supports that statement for only one of the two. For Note 3758900 the patch does remove the vulnerable servlet component outright (Onapsis Research Labs, 2026-08-11). For Note 3765948 (CVE-2026-44772, CVSS 9.9) the servlet stays in place, and Onapsis states the required remedy directly: "After implementing the patch, customers need to maintain the new system property 'Secure Transformer' with a list of allowed hosts for hosting XSL files. Only XSL files from these hosts can be consumed by the vulnerable servlet" (Onapsis Research Labs, 2026-08-11).
The practical consequence: an SAP Basis team that applied Note 3765948 and recorded the CVSS 9.9 flaw as remediated, without configuring the Secure Transformer allowed-hosts property, has not finished the remediation Onapsis describes: the property is what limits the vulnerable servlet to XSL files from the listed hosts. Teams that patched CVE-2026-44772 should verify the Secure Transformer property is now configured with an explicit allowed-hosts list, not merely that Note 3765948 shows as applied. Nothing about Note 3758900 (CVE-2026-44758) or any other flaw in this advisory round changes.
SAP Security Note 3773203 addresses CVE-2026-42945 in Commerce Cloud public-cloud deployments with NGINX (SAP SE, 2026-08-11); Onapsis states that the fix reaches customers when they build and deploy their Commerce Cloud applications (Onapsis, 2026-08-11). No cited source calls the vulnerable endpoint an import endpoint; SAP describes crafted input to functions that lack sufficient validation (BleepingComputer, 2026-08-14), and Onapsis names the vulnerable endpoint without naming its function (Onapsis Research Labs, 2026-08-11). On patch day NCSC-CH rated the exploitation status unknown (NCSC-CH, 2026-08-11). The status of CVE-2026-58231 no longer reads exploited: what is reported is exploitation attempts against Defused's honeypots and no compromised production instance (BleepingComputer, 2026-08-14), plus Defused's report of active scanning, which NCSC-NL relays (NCSC-NL, 2026-08-15).
Exploitation attempts against CVE-2026-58231 reached Defused's honeypots from 2026-08-14 (BleepingComputer, 2026-08-14). Rebuilding and redeploying the fixed Commerce Cloud release (Onapsis Research Labs, 2026-08-11) does not undo code execution that happened before it, so an instance redeployed after that date needs its access logs reviewed from 2026-08-14 to the redeploy for Data Hub Adapter requests from outside its integration sources.
Sources5
Revision history
- Published 2026-08-12T0411Z-intel
- Update 2026-08-16T0411Z-intel
CVE-2026-58231, the CVSS 10.0 unauthenticated code-execution flaw in the SAP Commerce Cloud Data Hub Adapter covered here on 2026-08-12 as unexploited, is now being attacked: Defused recorded the first exploitation attempts hitting its honeypot sensors on 2026-08-14, three days after SAP's patch day, and states no public proof-of-concept exists. NCSC-NL published advisory NCSC-2026-0302 on 2026-08-15 recording that attackers are actively scanning for vulnerable Data Hub Adapter systems. Shadowserver tracks over 4,200 internet-exposed instances, most in Europe and North America, and the Commerce Cloud fix only takes effect after a rebuild and redeploy, so an instance that merely took the note is still exposed.
Changed: actions cves evidence sources tags techniques body
- Correction 2026-08-28T0409Z-intel
This entry stated that SAP's fix "removes the vulnerable servlet component in both cases" for CVE-2026-44772 and CVE-2026-44758. Onapsis's own text says that only of Note 3758900 (CVE-2026-44758). For Note 3765948 (CVE-2026-44772, CVSS 9.9) the servlet is not removed; Onapsis states customers must additionally configure and maintain a new "Secure Transformer" system property naming the hosts allowed to serve XSL files to the servlet, or it remains reachable. The CVE-2026-44772 record and the body are corrected to name this required post-patch step.
Changed: cves body
- Correction 2026-10-11T1307Z-audit
The summary still said no party reported exploitation, which the entry's own update of 2026-08-16 superseded with Defused's honeypot attempts. The rebuild-and-redeploy requirement for the NGINX-related note comes from Onapsis rather than SAP's patch-day page and now carries that citation, the note is identified as SAP's fix for the upstream NGINX flaw, and the entry links the NGINX entry. The main analysis no longer says no party reports exploitation, and its two statements about where the component sits and where legitimate imports come from are marked as analyst judgement; the NCSC-NL evidence quote is given in English with the Dutch original, and two overlapping Commerce Cloud actions are merged. No cited source calls the vulnerable endpoint an import endpoint, so the title, action and detection lines name the Data Hub Adapter endpoint; the patch-day status follows NCSC-CH's unknown rating, the remaining inferences are marked as analyst judgement, the CVE-2026-58243 sentence gains its citation, and earlier sections no longer refer to the entry itself. CVE-2026-58231 is no longer marked exploited: the reports are Defused's honeypot attempts, which NCSC-NL relays, and no party reports a compromised instance, the same standard the nginx entry applies. Note 3773203 is described in SAP's own words, and the Data Hub Adapter record names the affected releases.
Changed: summary references body evidence actions title cves tags
- Improvement 2026-10-21T0800Z-audit
Exposure, detection and defender-takeaway lines now close the analysis. A Commerce Cloud instance redeployed after exploitation attempts began on 2026-08-14 needs its access logs reviewed from that date to the redeploy, since the redeploy does not undo earlier code execution. The Secure Transformer requirement for Note 3765948 is stated as Onapsis gives it: after the patch, the property limits the vulnerable servlet to XSL files from the listed hosts.
Changed: actions body cves sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.