Vulnerability · Published Aug 11, 2026 · Assigned by sap

CVE-2026-58231Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

Critical 10.0

In plain English

A critical-severity code injection in SAP Commerce Cloud (Data Hub Adapter) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.9%top 41.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP Commerce Cloud (Data Hub Adapter)	COM_CLOUD 22112211-JDK21

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References