AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SAPCVE-2026-58231

SAP Commerce Cloud (Data Hub Adapter): remote code execution

SAP

CVE-2026-58231 · Published Aug 11, 2026 · updated Aug 17, 2026

Critical10.0
No fix yet
SAP advisory

SAP Commerce Cloud allows an unauthenticated

attacker to abuse a default authentication client and submit specially crafted

input to certain functions lacking sufficient validation. Successful

exploitation could enable arbitrary code execution and compromise internal

components, resulting in high impact on confidentiality, integrity, and

availability of the application.

Affected versions

PackageAffectedFixed in
SAP Commerce Cloud (Data Hub Adapter)
Product
<= COM_CLOUD 2211No fix yet
<= 2211-JDK21No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-94

More SAP advisories

All SAP
Medium 5.9Aug 11SAP Business AI Platform (Approuter): improper signature checkCVE-2026-66776no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): path traversalCVE-2026-66777no fix yetMedium 5.3Aug 11SAP Approuter does not sufficiently sanitize certain request headers before...CVE-2026-66778no fix yetMedium 6.3Aug 11SAP NetWeaver Application Server ABAP: cross-site scriptingCVE-2026-66779no fix yetHigh 7.9Aug 11SAP BusinessObjects Business Intelligence Platform (Central : hard-coded keyCVE-2026-66763no fix yetMedium 4.3Aug 11SAP S/4 HANA (Reprocess Bank Statement Items): privilege escalationCVE-2026-66764no fix yet