Three days from patch to probe: SAP Commerce Cloud RCE is already being hunted

SAP shipped a fix on Tuesday for a maximum-severity remote code execution flaw in Commerce Cloud, and by Friday threat intelligence company Defused said the first exploitation attempts against it were landing in its honeypots ^[1][8][2]. That is a three-day window between advisory and in-the-wild targeting, which is shorter than most retail change-control cycles ^[1].

The bug, CVE-2026-58231, is an improper authorization weakness in the core Data Hub Adapter extension for Commerce Cloud, exploitable by an unprivileged attacker in a low-complexity attack to run arbitrary code ^[3]. SAP's own description is blunt about the mechanism: an unauthenticated attacker can "abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation" ^[4]. Successful exploitation, SAP says, "could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application" [c4a]. A default client plus missing input validation is not a chained, conditional exposure; it is the kind of defect that works against a stock install.

Commerce Cloud, formerly SAP Hybris, runs online storefronts for large retailers and global brands ^[6]. Shadowserver tracks more than 4,200 IP addresses carrying a Commerce Cloud fingerprint, concentrated in Europe and North America ^[9]. That number is an upper bound on attack surface, not a victim count: there is no breakdown of how many are honeypots or already patched ^[10].

The gap worth noting is between the vendor's paperwork and the observed traffic. SAP has not flagged CVE-2026-58231 as actively exploited in its advisory ^[8], and Defused's own note said the vulnerability "has no public PoC and is not known to be exploited" at the time attempts appeared ^[2]. Someone is working from the patch, or from something not public. Either way, defenders relying on an "exploited in the wild" label to trigger emergency change approval will be waiting behind the attackers.

Context matters for how much benefit of the doubt this platform has earned. SAP fixed 16 vulnerabilities in its July 2026 patch package and 30 more across June and May ^[11][12], which is 46 in three months ^[15]. Three of those were additional critical flaws in Commerce Cloud specifically: CVE-2026-44761, CVE-2026-22732, and CVE-2026-34263 ^[12]. In April, Aikido and Socket reported that attackers had compromised multiple official SAP npm packages to steal credentials from developer systems ^[13]. Since November 2021, CISA has added 14 SAP vulnerabilities to its Known Exploited Vulnerabilities catalog, three of which were abused in ransomware attacks ^[7]. The installed base makes the stakes plain: SAP serves 99 of the 100 largest companies worldwide and reported revenues above EUR 36 billion in fiscal 2025 ^[14].

Three things to watch. First, whether SAP amends its advisory to mark CVE-2026-58231 as exploited, and how long that takes relative to the honeypot data. Second, whether CISA adds it to KEV, which would put a federal remediation clock on it and, historically for SAP bugs, has preceded ransomware use in three cases ^[7]. Third, the Shadowserver count: a falling fingerprint total is the closest available proxy for patch uptake, since exposure here is measured in reachable storefronts ^[9][10]. For teams running Commerce Cloud, the practical question is not whether the patch is scheduled but whether the Data Hub Adapter endpoint is reachable from the internet in the meantime.