SAP Commerce Cloud RCE Hits CVSS 10.0, 29 Patches

The flaw sits inside the Data Hub Adapter, a component many retailers rely on to move product and order data to their online storefronts. SAP shipped a fix on August 11 as part of its monthly Security Patch Day. Honeypot sensors run by threat intel firm Defused caught the first exploit attempts just three days later, on August 14. The Dutch national cyber agency NCSC-NL issued an advisory the following day, documenting active scanning for vulnerable systems.

A Default Client Nobody Locked Down

The root cause traces back to a default authentication client shipped with the platform. Combined with insufficient input validation, that default client opens the door to arbitrary code execution. According to The Hacker News, attackers can submit crafted input to the Data Hub import endpoint, and the application simply fails to validate it before executing code on the server.

An unauthenticated attacker can reach the vulnerable endpoint with no password, no phishing, and no user interaction required. That combination of maximum severity and zero barrier to entry is exactly why this flaw jumped to active exploitation so fast.

What Attackers Get Once They’re In

A compromised Commerce Cloud instance can expose customer data, including order histories and account details. From there, attackers can pivot to connected back office systems like ERP and payment processing, according to CSO Online. That opens the door to both data theft and broader operational disruption.

Business continuity takes a direct hit too. Someone with code execution on a live commerce platform can disrupt checkout or inventory systems during peak sales periods. No specific retailer has publicly confirmed a breach tied to this CVE as of August 31.

Why the Fix Isn’t Quick

SAP’s fix isn’t a simple hotfix you drop in and walk away from. Applying Security Note 3771065 requires customers to update to a patched Commerce Cloud release, then rebuild and redeploy the entire Data Hub Adapter component. For large retailers with strict change control processes, that’s real friction, especially heading into the fall shopping season.

In the meantime, interim controls include restricting network access to the Data Hub Adapter and disabling the default authentication client entirely. Here’s what that restriction looks like at the network level:

# Example nginx access restriction for the Data Hub import path
location /datahub-webapp/ {
    allow 10.0.0.0/8;  # internal integration network only
    deny all;
    proxy_pass http://commerce-datahub-backend;
}

Onapsis, an SAP security consultancy, is urging customers to skip the interim measures where possible and move straight to a full patch and redeploy.

Timeline of the Exploit

One of 29, But the Only Perfect Score

SAP’s August 2026 Security Patch Day included 29 notes total, with four rated critical. CVE-2026-58231 was the only one to hit a full CVSS 10.0.

• Critical: 4 notes, including this Data Hub Adapter flaw
• High: 8 notes, mostly additional Commerce Cloud and NetWeaver issues
• Medium/Low: 17 notes, largely configuration hardening and minor input validation fixes

This isn’t SAP’s first brush with a perfect score. The 2020 RECON vulnerability and 2025’s CVE-2025-31324 in NetWeaver Visual Composer both hit CVSS 10.0 under nearly identical circumstances: unauthenticated access, no user interaction required, maximum impact across confidentiality, integrity, and availability.

Hashlytics Take

Three perfect CVSS scores in six years, all tracing back to components meant for internal communication that somehow ended up exposed, isn’t bad luck. It’s a pattern in how SAP ships defaults. A component built to talk to other internal systems shouldn’t need a customer to remember to lock it down after installation, yet that’s exactly the failure mode repeating across RECON, NetWeaver, and now Commerce Cloud. Until SAP treats “secure by default” as the actual default rather than a configuration step customers can skip, this same story will run again in a year or two with a different component name.