SAP patches perfect-10 flaw in Commerce Cloud that let anyone run code

Key points

• SAP has patched CVE-2026-58231, a flaw in SAP Commerce Cloud rated 10.0 on the CVSS severity scale, the highest possible score.
• The bug sits in the Data Hub Adapter and stems from missing authorisation checks and weak input validation.
• An attacker with no login could run their own code on a vulnerable system, according to SAP's advisory.
• No public reports of exploitation have surfaced yet, but a 10.0 score means administrators should patch without waiting for the next maintenance window.

SAP has shipped a fix for a critical bug in its Commerce Cloud product that could let an outsider, with no username or password, run whatever code they like on the server.

The flaw is tracked as CVE-2026-58231 and scores a full 10.0 on CVSS, the industry's standard severity scale that tops out at 10. Ratings that high are rare. They usually mean the bug is easy to reach over the network, needs no authentication, and hands the attacker deep control.

This one ticks all three boxes.

What is the bug, in plain English?

It is a hole in the Data Hub Adapter, a piece of SAP Commerce Cloud that shuffles data between the storefront and other business systems. SAP's advisory blames "insufficient authorization checks and input validation," which is jargon for two related failures: the software did not properly check who was asking, and it did not properly check what was being sent.

Put together, those two gaps let an unauthenticated attacker send a crafted request and get the server to execute their code. That is called arbitrary code execution, and in practice it means the attacker can install malware, steal data, or pivot deeper into the network.

Who runs SAP Commerce Cloud?

Mostly large retailers, manufacturers, and B2B sellers. It powers online storefronts, product catalogues, and order flows for enterprises that sit well outside the consumer eye. If you have bought industrial parts, insurance add-ons, or telco services online, there is a reasonable chance an SAP Commerce back end handled the transaction.

That matters because these systems typically hold customer records, order history, and payment metadata. A full takeover is a serious data exposure risk.

How urgent is the patch?

Very. A 10.0 with no authentication required is the kind of finding attackers race to weaponise once details land in public. Historically, SAP bugs of this class have been folded into opportunistic scanning within days of disclosure, as first reported by The Hacker News among others covering SAP's monthly patch cycle.

As of writing, there is no public proof-of-concept exploit and no confirmed in-the-wild activity tied to CVE-2026-58231. That will likely change. Defenders should assume the window is short.

What should customers do?

Apply SAP's patch now, not at the next quarterly window. If patching immediately is not possible, restrict network access to the Data Hub Adapter so only trusted internal systems can reach it, and watch logs for unusual POST requests or unexpected outbound connections from the Commerce Cloud host.

End customers of retailers running SAP Commerce do not need to do anything themselves. There is no consumer-side action here. But if your retailer notifies you of a data incident in the coming weeks, treat the notice seriously and change any password you reused elsewhere.

A note on attribution

No group has been linked to this flaw. There is no reporting of exploitation by named clusters such as FIN7 or the various ransomware crews that have targeted SAP systems in the past. Capability to abuse a bug like this is broad; intent, at this stage, is unproven.