Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

SAP Commerce Cloud Data Hub Adapter Authentication Bypass

CVE-2026-58231 · published 24 days ago
Summary

An attacker without a login can potentially execute unauthorized code in SAP Commerce Cloud's Data Hub Adapter, compromising internal components and putting sensitive data at risk. This is a serious issue because it allows unauthorized access and could lead to data loss or system crashes. SAP users should update their Data Hub Adapter to the latest version and ensure proper authentication is enabled to prevent this attack.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sap_se sap commerce cloud (data hub adapter) COM_CLOUD 2211
Original advisory text
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful expl...
SAP Commerce Cloud allows an unauthenticated
attacker to abuse a default authentication client and submit specially crafted
input to certain functions lacking sufficient validation. Successful
exploitation could enable arbitrary code execution and compromise internal
components, resulting in high impact on confidentiality, integrity, and
availability of the application.
References
Severity
10.0 Critical
CVSS 3.1: 10.0 (MITRE)
Exploitation
EPSS 2%
Type
CWE-94Code Injection
Timeline
Published11 Aug 2026
Updated30 Aug 2026
First seen11 Aug 2026
Sources
CVE-2026-58231 · NVD
CVE-2026-58231 · MITRE
Monitor software like this
Free during beta