SAP Commerce Cloud CVE-2026-58231: CVSS 10.0 RCE
SAP Commerce Cloud CVE-2026-58231, a maximum-severity (CVSS 10.0) flaw disclosed on SAP’s August 2026 Security Patch Day, lets an unauthenticated attacker with network access reach the Data Hub import endpoint and potentially execute arbitrary code — no login, no user interaction, just a crafted request to a component many DACH e-commerce and manufacturing storefronts run in production.
What Happened
SAP’s August 2026 Security Patch Day fixed 40 CVE-numbered issues across its product line, four of them rated critical. The most severe is SAP Commerce Cloud CVE-2026-58231, an improper-authorization vulnerability in the Data Hub Adapter component affecting COM_CLOUD versions 2211 and 2211-JDK21. The adapter’s import endpoint (/datahubadapter/import/**) processes incoming data without properly verifying the caller’s identity. An unauthenticated remote attacker with network access to that endpoint can submit crafted data that the adapter processes as trusted input, potentially resulting in arbitrary code execution on the Commerce Cloud instance.
SAP’s fix requires upgrading to Commerce Cloud release 2211.55 or 2211-jdk21.17 (or later) under Security Note 3771065 — this is not a configuration toggle, it requires rebuilding and redeploying the environment. Until that upgrade is completed, SAP’s documented interim mitigation is to configure an IP Filter Set restricting access to the Data Hub import endpoint to trusted Data Hub server addresses only. The same Patch Day also closed critical code-injection and memory-corruption vulnerabilities in SAP NetWeaver Application Server ABAP and SAP Approuter, both independently confirmed via SAP’s own security notes and third-party analysis from Onapsis and Pathlock.
Why It Matters
SAP Commerce Cloud (formerly Hybris) is a common e-commerce and B2B storefront platform for DACH retail, manufacturing and consumer-goods companies running SAP as their ERP backbone. A successful exploit of this authorization bypass can expose customer and order data, tamper with storefront or integration behavior, and compromise credentials or services the Commerce environment trusts — a direct line into both customer-facing operations and whatever backend systems the storefront integrates with. This is the third distinct SAP-ecosystem incident DIESEC has tracked in 2026, following a CVSS 9.9 authorization flaw in SAP CRM/S4HANA (February) and a supply-chain compromise of SAP CAP npm packages (May) — three different attack surfaces within the same vendor stack inside six months.
What You Should Do Now
- Identify every SAP Commerce Cloud instance on COM_CLOUD 2211 or 2211-JDK21 and prioritize the upgrade to 2211.55 / 2211-jdk21.17 or later — this requires a rebuild/redeploy, so schedule it as a project, not a config change.
- Until the upgrade ships, apply SAP’s documented IP Filter Set to restrict
/datahubadapter/import/**to known, trusted Data Hub server addresses immediately — this is the fastest available risk reduction. - Review Data Hub Adapter access logs for requests from unexpected source IPs to the import endpoint, since exploitation requires no authentication and would not necessarily trigger existing alerting.
- Audit credentials and downstream services the Commerce Cloud environment trusts (payment gateways, order-management integrations) so you know what to rotate if compromise is later confirmed.
DIESEC Perspective
Three major SAP-ecosystem incidents in six months, each in a different layer — core ERP, developer supply chain, now the customer-facing commerce platform — is a pattern DACH organizations running SAP should treat as a standing patch-governance priority across the whole stack, not a series of unrelated one-off advisories to react to individually.
Not sure whether your SAP Commerce Cloud environment is still exposed on an unpatched Data Hub Adapter build? Contact DIESEC for a rapid SAP patch verification and exposure review.
Sources: SecurityWeek | Onapsis
Published: 2026-08-14 | Category: Vulnerabilities & Patches | ~4 min read
