What’s Vulnerable › Vulnerabilities

CVE-2026-58231: Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-94

Description

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

Affected products

• SAP_SE SAP Commerce Cloud (Data Hub Adapter): COM_CLOUD 2211, 2211-JDK21

References

• https://me.sap.com/notes/3771065
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-58231 or the next vulnerability affects your stack