Critical SAP Commerce Cloud flaw exploited days after patch

A maximum-severity bug in SAP Commerce Cloud was exploited in the wild, research group Defused posted on X Aug. 14.

The 10.0 bug — CVE-2026-58231 — was described as having insufficient authorization checks and input validation and was earlier patched by SAP on Aug. 11.

SAP Commerce Cloud helps large companies run complex B2B, B2C, and B2B2C online sales operations. Major businesses in the automotive, technology, energy, and retail sectors run the platform, including Samsung, Mercedes-Benz, Shell, BP, and Alphabet, parent company of Google.

Chris Radkowski, GRC Expert at Pathlock, said SAP environments keep getting hit with critical, unauthenticated flaws because they sit at the center of so much business-critical data and process.

“The lesson from CVE-2026-58231 isn't just 'patch faster,'” said Radkowski. “It's that every SAP customer needs visibility into what's happening inside these systems in real time, so a delayed patch or a missed alert doesn't turn into a much longer story.”

Gunter Ollmann, chief technology officer at Cobalt, added that three days from patch to active exploitation is no longer an outlier: it’s becoming the expected timeline for critical, remotely exploitable vulnerabilities in widely deployed enterprise platforms. 

“What’s changing is how fast the reverse engineering happens,” said Ollmann. “Diffing a patch against the prior release used to take a skilled researcher real time and effort. AI-assisted code analysis tools are collapsing that timeline, letting attackers automate the comparison, spot the exact logic that changed, and generate working exploit material in a fraction of the time it once took. We are watching patch-to- exploit windows shrink from days toward minutes for certain vulnerability classes, and that trend will only accelerate.”

Ollmann said SAP Commerce Cloud stands as a particularly attractive target because it sits at the center of ecommerce and customer transaction infrastructure, meaning a compromise can expose far more than a single server. Honeypot telemetry detecting exploitation before a public proof-of-concept existed here, which Ollmann said reinforces that sophisticated actors are moving on their own accelerated timeline, not the public research timeline.

“Organizations running SAP Commerce Cloud should treat patch deployment as time sensitive rather than scheduled maintenance, and assume automated exploitation attempts are already underway against internet-facing instances,” said Ollmann. “Defenders waiting for a published exploit before prioritizing a fix are now working against a window measured in hours, not days."