SAP Commerce Cloud CVE-2026-58231: Active Exploit Attempts for Unauthenticated RCE

SAP Commerce Cloud contains a critical flaw, identified as CVE-2026-58231, that enables attackers to achieve remote code execution (RCE) without requiring any authentication. This vulnerability stems from a combination of default authentication client issues and input validation flaws in the Data Hub Adapter. The exploit has been actively attempted, as confirmed by a honeypot three days following the release of a security patch.

While the exact points of execution and post-exploitation activities remain undisclosed, the presence of numerous IP addresses associated with the product, as reported by Shadowserver, suggests a potential risk of unpatched, vulnerable, or compromised systems. On successful exploitation, attackers can gain unauthenticated arbitrary code execution, compromising internal components and severely impacting the application's confidentiality, integrity, and availability.

Immediate actions should include applying the noted security patch and implementing additional measures such as IP filtering and isolation of the Data Hub Adapter to mitigate the risk of attacks.