Attackers have started exploiting a maximum-severity SAP Commerce Cloud vulnerability just three days after the vendor shipped a patch. Security firm Defused Cyber said its honeypots recorded the first exploitation attempts against CVE-2026-58231, a CVSS 10.0 flaw with no public proof of concept.
An unauthenticated user can abuse a default authentication client and send crafted input to functions that skip proper validation. Success means arbitrary code execution and a compromised internal component set, with SAP rating the impact high across confidentiality, integrity, and availability.
Critical SAP bugs have drawn both ransomware gangs and Chinese-state actors, including UNC5221 and UNC5174, in past campaigns, researchers point out. The operators behind this wave are still unidentified.
Organizations running SAP Commerce Cloud should treat the patch as urgent and prioritize deployment, since exploitation began before most defenders would have completed their patch cycles. Monitoring for unusual requests to Commerce Cloud endpoints is advised while the investigation continues.
