A perfect CVSS score vulnerability (10.0) in SAP Commerce Cloud
SAP released its monthly security patches on Tuesday, August 11, 2026, as part of its SAP Security Patch Day. The batch includes a maximum severity vulnerability affecting SAP Commerce Cloud, specifically its Data Hub Adapter component. Identified by the identifier CVE-2026-58231, it has a CVSS 3.1 score of 10.0 out of 10 — the highest possible level.
According to the official description in the NIST NVD database: “SAP Commerce Cloud allows an unauthenticated attacker to exploit a default authentication client and submit specially crafted inputs to certain functions lacking sufficient validation. Successful exploitation could allow arbitrary code execution and compromise of internal components, with a significant impact on the confidentiality, integrity, and availability of the application.”
Technical details
The vulnerability is classified under CWE-94 (Improper Control of Generation of Code, or code injection). Its full CVSS vector — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — reveals several alarming features:
- Network attack vector (AV:N): remotely exploitable, without local access;
- Low attack complexity (AC:L): no specific technical conditions are required;
- No privileges required (PR:N): the attacker does not need to be authenticated;
- No user interaction (UI:N): exploitation does not require any action from a legitimate user;
- Scope change (S:C): the impact can extend beyond the initially targeted component.
The affected versions identified by SAP SE in the CVE record are:
- COM_CLOUD 2211
- COM_CLOUD 2211-JDK21
The patch is referenced in SAP Security Note 3771065.
CISA assessment: automatable, total impact
The CISA (Cybersecurity and Infrastructure Security Agency) has already included this vulnerability in its SSVC (Stakeholder-Specific Vulnerability Categorization) analysis. Its verdict, updated on August 12, 2026, is unequivocal:
- Exploitation: none known at this stage in the wild;
- Automatable: yes — the flaw can be exploited in an automated large-scale manner;
- Technical impact: total.
The current lack of active exploitation should not, however, provide undue reassurance: the unauthenticated, automatable, and total impact nature makes it an ideal candidate for large-scale campaigns if a public exploit were to circulate.
Mitigation measures and recommendations
The company Onapsis, a specialist in SAP systems cybersecurity, has urged customers to apply the patch immediately. The recommended procedure involves two steps:
- Patch to a fixed version of Commerce Cloud;
- Re-deploy the updated SAP Commerce Cloud version.
Until the patch can be applied, Onapsis recommends a temporary workaround: configure an IP Filter Set to restrict access to the vulnerable endpoint, thereby reducing the attack surface.
Three other critical vulnerabilities patched in the same update
The August 2026 update from SAP is not limited to the Commerce Cloud flaw. Three other critical severity vulnerabilities have also been fixed:
CVE-2026-44772 (CVSS 9.9) — Code injection in SAP MII
This vulnerability affects SAP Manufacturing Integration and Intelligence (MII). It is a code injection flaw that allows an attacker with low privileges to submit specially crafted input that causes the application to retrieve and process attacker-controlled content from an external source, leading to arbitrary command execution on the underlying host system.
The patch simply removes the vulnerable servlet. After applying the patch, customers must configure a new system property called “Secure Transformer” containing a list of hosts allowed to host XSL files. Only XSL files from these hosts will be consumable by the servlet.
CVE-2026-34265 (CVSS 9.8) — Memory corruption in SAP NetWeaver ABAP
This vulnerability targets SAP NetWeaver Application Server ABAP (for SAP NetWeaver and ABAP Platform). Classified under CWE-787 (Out-of-bounds Write), it allows a unauthenticated attacker to exploit logical errors in the DIAG protocol analysis, causing memory corruption.
The potential consequences include the disclosure of sensitive system information or system crashes. The list of affected versions is particularly extensive, covering many SAP kernels:
- KRNL64NUC 7.22, 7.22EXT
- KRNL64UC 7.22, 7.22EXT2, 7.22EXT3
- 7.53, 7.54, 7.77, 7.89, 7.93
- 8.04, 9.16, 9.18, 9.19
- KERNEL 7.22, 9.16, 9.18
The patch is available via SAP Security Note 3714806. CISA has assessed this vulnerability as automatable with a total technical impact.
CVE-2026-44758 (CVSS 9.1) — Code injection in SAP MII via SSTI/SSRF
Still in SAP Manufacturing Integration and Intelligence (MII), this vulnerability (classified as CWE-94) requires an attacker with high privileges. According to Onapsis analyses, it involves a servlet component vulnerable to server-side template injection (SSTI) and Server-Side Request Forgery (SSRF), potentially paving the way for command execution on the underlying operating system.
The affected versions are XMII 15.4 and 15.5. The patch (SAP Security Note 3758900) removes the vulnerable servlet component. CISA has deemed this flaw not automatable (due to the high privilege requirement), but with a total technical impact.
Context: the SAP Security Patch Day
The SAP Security Patch Day occurs every second Tuesday of the month, in synchronization with the update cycles of other major software vendors (Microsoft, Adobe, etc.). For August 2026, it fell on August 11, the day before the publication of the article by The Hacker News.
On this occasion, SAP publishes SAP Security Notes — software fixes focused solely on security. The publisher classifies these notes by severity and recommends their application as a priority, especially for high or critical severity notes (CVSS ≥ 7.0).
Key takeaways
This wave of patches illustrates a recurring pattern in the SAP ecosystem: critical components (Commerce Cloud, NetWeaver, MII) expose flaws allowing remote code execution without authentication, with potentially total impact on the three pillars of security (confidentiality, integrity, availability). The presence of an exploitable default authentication client in the case of CVE-2026-58231 underscores the importance of hardening default configurations of enterprise solutions.
For organizations using SAP Commerce Cloud version 2211, applying the patch via SAP Note 3771065 should be regarded as an absolute priority. In the meantime, implementing IP filtering on the vulnerable endpoint represents the bare minimum to reduce exposure.