SAP Patches Critical Commerce Cloud Flaw Enabling Remote Code Execution

SAP has rolled out emergency patches for a maximum-severity vulnerability in SAP Commerce Cloud (Data Hub Adapter) that could allow unauthenticated attackers to execute arbitrary code on affected systems. Tracked as CVE-2026-58231 and assigned a perfect CVSS score of 10.0, the flaw stems from insufficient authorization checks and input validation. According to CVE.org, attackers can abuse a default authentication client to submit specially crafted input to vulnerable functions, potentially compromising internal components and impacting confidentiality, integrity, and availability. Security firm Onapsis is urging customers to update immediately and re-deploy the patched SAP Commerce Cloud version. As an interim measure, administrators can restrict access through IP Filter Set configurations, a step worth verifying alongside a quick port scanner review to confirm exposed endpoints are properly isolated.

The August 2026 SAP security update addresses three additional critical flaws. CVE-2026-44772 (CVSS 9.9) is a code injection vulnerability in Manufacturing Integration and Intelligence that lets low-privileged attackers trigger arbitrary command execution by forcing the application to fetch attacker-controlled content. CVE-2026-34265 (CVSS 9.8) is an out-of-bounds write vulnerability in Application Server ABAP for SAP NetWeaver, exploitable through logical errors in DIAG protocol parsing and capable of causing memory corruption, system crashes, or sensitive data disclosure. CVE-2026-44758 (CVSS 9.1) targets the same Manufacturing Integration and Intelligence product via a vulnerable servlet susceptible to server-side template injection (SSTI) and server-side request forgery (SSRF), enabling OS-level command execution by attackers with high privileges. SAP removed the affected servlet component to remediate the issue.

For CVE-2026-44772, Onapsis noted that patched deployments require administrators to maintain a new system property called 'Secure Transformer,' which restricts XSL file consumption to a curated list of approved hosts. Organizations running SAP environments should verify their certificate posture using an SSL/TLS checker and validate the integrity of any third-party integrations feeding into Commerce Cloud or NetWeaver components. CVE-2026-58231's unauthenticated attack vector makes internet-facing SAP deployments particularly exposed, especially those relying on default authentication clients.

Given the criticality of these flaws and the unauthenticated nature of the most severe one, SAP customers should treat this patch cycle as urgent priority. Security teams are advised to audit their SAP landscapes, apply fixes without delay, and conduct a broader WHOIS lookup on any unfamiliar external hosts referenced in XSL configurations to rule out attacker-controlled infrastructure. The combination of authentication bypass, code injection, and memory corruption vulnerabilities underscores the importance of layered defenses and continuous monitoring across enterprise SAP environments.