SAP Commerce Cloud CVSS 10 RCE — Patch Released

CVSS 10.0. Unauthenticated remote code execution. SAP Commerce Cloud.

SAP has released patches for CVE-2026-58231, a maximum-severity flaw in the Commerce Cloud Data Hub Adapter. An unauthenticated attacker can exploit the flaw to execute arbitrary code on the affected system. Root cause: insufficient authorization checks combined with missing input validation, as reported by The Hacker News citing the SAP advisory.

Exploitation status: unconfirmed as of this writing. Treat accordingly — CVSS 10 disclosures historically attract scanning within hours of public release.

What’s Broken

The Data Hub Adapter is the Commerce Cloud component that integrates with external data sources: SAP S/4HANA, ERP systems, third-party data pipelines. Two weaknesses combine here:

1. No authorization check on inbound requests to the vulnerable endpoint. No credentials required to reach it.
2. No input validation on the data those requests carry.

Result: unauthenticated remote code execution. CVSS 10.0 is the ceiling of the scoring system. This flaw hits it.

Who’s at Risk

SAP Commerce Cloud — formerly Hybris — runs large-scale e-commerce workloads at retail, manufacturing, and B2B organizations. The Data Hub Adapter is commonly enabled in deployments that integrate with the broader SAP enterprise stack.

Exposure conditions: your Commerce Cloud instance uses the Data Hub Adapter, and it’s reachable from untrusted networks or from any segment an attacker could access.

Specific affected version ranges were not confirmed from a primary source at publication. Check the NVD record for CVE-2026-58231 and SAP Security Notes via the SAP Support Portal for version-level guidance.

What to Do

Patch. SAP has issued the fix. That is the action.

Supporting steps while the patch window is scheduled:

• Restrict network access. Block untrusted network segments and external interfaces from reaching the Data Hub Adapter endpoint.
• Check endpoint logs. Look for unexpected requests to Data Hub Adapter endpoints since August 12. Scanning activity on fresh CVSS 10 disclosures moves fast.
• Confirm your version. Verify against SAP Security Notes before declaring your environment clear.
• Disable if unused. If your deployment does not use the Data Hub Adapter, disable it at the application level as a precaution.

No workaround substitutes for patching on a CVSS 10.0 unauthenticated RCE.

---

Full CVE details: CVE-2026-58231. Monitor active exploitation on the KEV tracker.