Researchers warn that a critical vulnerability in SAP Commerce Cloud is facing exploitation just days after the company issued a patch.
Defused, a firm that specializes in threat intelligence, said Friday that it detected initial exploitation activity against the flaw, which is tracked as CVE-2026-58231, according to a post on X. Exploitation began hitting the security firm’s honeypots just three days after the patch was issued, according to Defused.
“There has been only one actor to date that has attempted exploitation of CVE-2026-58231 so does not seem to be widespread,” Simo Kohonen, founder and CEO of Defused, told Cybersecurity Dive via email.
Defused said that no proof of concept had been issued previously, nor had the vulnerability previously been exploited.
The vulnerability allows attackers to abuse a default authentication client. Successful exploitation could potentially lead to arbitrary code execution, and internal components could be compromised.
The vulnerability has a severity score of 10, which is the highest level of potential impact.
SAP Commerce Cloud is an enterprise-level platform that helps businesses run e-commerce stores.
Researchers at security firm watchTowr said the vulnerability is very easy to exploit and opens up a vast amount of sensitive data to an attacker.
“With just a few requests, an attacker can compromise an internet-facing instance designed to hold customer PII while being connected directly to other business systems and services,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr: “These products are attacker goldmines, offering direct access to sensitive data, credentials, and a fast lane to other systems once a foothold is established.”
A spokesperson for SAP said the company is is investigating. SAP issued a security note for customers and partners as part of its August Patch Day release.
“We recommend customers and partners patch their systems with immediate effect,” the spokesperson told Cybersecurity Dive.
Researchers at Onapsis noted that customers need to patch to the fixed Commerce Cloud release levels and then rebuild or redeploy their updated Commerce Cloud version, according to a blog post released by the security firm. If customers need a temporary workaround, they can configure an IP Filter Set in SAP Commerce Cloud to reduce exposure to the vulnerable endpoint, according to Onapsis.
SAP in 2024 rolled out cloud-based payments capabilities to beef up services on its e-commerce platform.
Editor’s note: Adds comments from watchTowr, SAP and Onapsis.
