SAP Patches a Critical 10-out-of-10 Vulnerability in Commerce Cloud

SAP has released patches for a maximum-severity vulnerability affecting Commerce Cloud — specifically the Data Hub Adapter component. The bug has been assigned the identifier CVE-2026-58231 and the highest possible score on the CVSS scale: 10.0.

The issue stems from insufficient authorization checks and weak input validation. According to the description on CVE.org, SAP Commerce Cloud allows an unauthenticated attacker to abuse the default authentication client and pass specially crafted data into functions where validation is poorly implemented. Successful exploitation opens the door to arbitrary code execution and the compromise of internal components, striking at the application's confidentiality, integrity and availability all at once.

Onapsis, a company specializing in SAP security, advises customers to upgrade to the fixed version of Commerce Cloud and redeploy it. As a temporary measure until the patch is installed, it suggests restricting access to the vulnerable endpoint using a set of IP filters.

Three more critical holes

SAP's August update also closed other serious flaws. CVE-2026-44772 (9.9) is a code-injection vulnerability in Manufacturing Integration and Intelligence: an attacker with low privileges can send specially crafted data that forces the application to load and process content from an external source, ultimately leading to command execution on the host. After installing the patch, customers will have to configure a new Secure Transformer system property with an allowlist of hosts — only XSL files from those hosts will be processed.

CVE-2026-34265 (9.8) is an out-of-bounds write in the ABAP application server for SAP NetWeaver and the ABAP platform. An unauthenticated attacker can exploit logic errors in the parsing of the DIAG protocol to cause memory corruption. This risks the leakage of sensitive system information or a system crash.

CVE-2026-44758 (9.1) is another code-injection vulnerability in Manufacturing Integration and Intelligence, available to an attacker with high privileges. According to Onapsis, it involves a servlet susceptible to server-side template injection (SSTI) and server-side request forgery (SSRF) attacks, which could have led to command execution. SAP's patch simply removes the vulnerable component.

All users of the affected SAP products should install the updates without delay: the combination of unauthenticated access and arbitrary code execution makes flaws like these especially attractive to attackers.

Source: The Hacker News