{"id":"CVE-2026-58231","published":"2026-08-11T10:21:29Z","modified":"2026-08-12T03:59:57Z","title":"Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)","vendor":"SAP_SE","product":"SAP Commerce Cloud (Data Hub Adapter)","tier":"core","eol":null,"affectedVersions":[{"vendor":"SAP_SE","product":"SAP Commerce Cloud (Data Hub Adapter)","versions":["COM_CLOUD 2211","2211-JDK21"]}],"description":{"text":"SAP Commerce Cloud allows an unauthenticated\nattacker to abuse a default authentication client and submit specially crafted\ninput to certain functions lacking sufficient validation. Successful\nexploitation could enable arbitrary code execution and compromise internal\ncomponents, resulting in high impact on confidentiality, integrity, and\navailability of the application.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an improper authorization issue in the Data Hub Adapter component of SAP Commerce Cloud, where a default authentication client can be abused and certain functions fail to validate submitted input. An unauthenticated attacker with network access can exploit it without user interaction or special configuration, and successful exploitation could enable arbitrary code execution and compromise internal components of the application.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:53:59Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00855,"percentile":0.58328,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-14","exploitedFirstSeen":"2026-08-14","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-58231","date":"2026-08-14"},{"url":"https://x.com/DefusedCyber/status/2088240809355153647","date":"2026-08-14"},{"url":"https://securityaffairs.com/197244/security/sap-commerce-cloud-cve-2026-58231-exploited-in-the-wild.html","date":"2026-08-15"},{"url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/","date":"2026-09-03"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":17,"pulses":[{"name":"PaperCut NG/MF chained flaws exploited for unauthenticated code execution","url":"https://otx.alienvault.com/pulse/6accfd981a9a5c9e70ed13cd","created":"2026-10-12"},{"name":"ServiceNow AI Platform CVSS 10.0 Unauth Code Injection, Access Control, and SQLi (Aug 2026)","url":"https://otx.alienvault.com/pulse/6a93c7e09c5f2bc6dcd626cc","created":"2026-08-30"},{"name":"CISA KEV Aug 2026: NetScaler CVE-2026-8452 Web Shells + SQL Server/Linux/AjaxPro","url":"https://otx.alienvault.com/pulse/6a92768c2c6b51e72cd86fb9","created":"2026-08-29"},{"name":"PaperCut NG/MF Unauth RCE Chain CVE-2026-81578 + CVE-2026-82078","url":"https://otx.alienvault.com/pulse/6a92768bd33a1062c052d128","created":"2026-08-29"},{"name":"Next.js Critical RCE: CVE-2026-75604 Windows Path Traversal + AVIF/libheif Overflow","url":"https://otx.alienvault.com/pulse/6a9125595b949155860f25cb","created":"2026-08-28"},{"name":"miniOrange WordPress SAML Auth Bypass (CVE-2026-15981 / CVE-2026-61979) Active Scanning","url":"https://otx.alienvault.com/pulse/6a91254414ce28be7487a61c","created":"2026-08-28"},{"name":"Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available","url":"https://otx.alienvault.com/pulse/6a905e4c975d46a29ad8e05a","created":"2026-08-27"},{"name":"Gitea CVE-2026-60004 RCE Actively Exploited (KEV) — Miner-like Payload","url":"https://otx.alienvault.com/pulse/6a8fd35e07b57234f22ff6b7","created":"2026-08-27"},{"name":"CVE-2026-21962 Oracle WebLogic/HTTP Server KEV Active Exploitation","url":"https://otx.alienvault.com/pulse/6a8e81f6510601760a6fd93e","created":"2026-08-26"},{"name":"24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages","url":"https://otx.alienvault.com/pulse/6a8d91072bd52b5a60a0025e","created":"2026-08-25"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://me.sap.com/notes/3771065","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-55999","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-55999","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2026-08-15","earliestUrl":"https://github.com/HORKimhab/CVE-2026-58231","repos":[{"name":"HORKimhab/CVE-2026-58231","url":"https://github.com/HORKimhab/CVE-2026-58231","stars":0,"created":"2026-08-15"},{"name":"WildanDeveloper/CVE-2026-58231","url":"https://github.com/WildanDeveloper/CVE-2026-58231","stars":0,"created":"2026-08-22"}]},"first":{"date":"2026-08-15","source":"PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2026-58231"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-08-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-58231","provenance":"source"},{"date":"2026-08-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-58231","provenance":"source"},{"date":"2026-08-15","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2026-58231","provenance":"source"}],"speed":{"daysToPublicExploit":4,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":71.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 78 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":11.67,"detail":"percentile 0.5833"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.85,"detail":"17 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}