SAP's CVSS 10.0 Commerce Cloud bug needs a re-deploy, not just a patch window

SAP has patched a maximum-severity flaw in Commerce Cloud's Data Hub Adapter that can end in arbitrary code execution ^[1]. The vulnerability, CVE-2026-58231, carries a CVSS score of 10.0 and is described as a combination of insufficient authorization checks and insufficient input validation ^[2][3], which is the short version of "there is nothing standing between the request and the code path."

The CVE.org description is specific about the entry point: an unauthenticated attacker can abuse a default authentication client and submit specially crafted input to certain functions that lack sufficient validation ^[4]. Successful exploitation could enable arbitrary code execution and compromise internal components, with high impact on the confidentiality, integrity and availability of the application ^[5]. A default client plus an unauthenticated path is the combination that turns a scanner hit into an incident, because there is no credential to steal first.

The operational problem is the remediation shape. Onapsis, an SAP security vendor, has told customers to patch to a fixed Commerce Cloud release and then re-deploy the updated version ^[6]. That is not a maintenance-window patch you can slide in at 2am on a Tuesday; it is a build and deployment cycle against a system that fronts customer transactions. Until that lands, Onapsis says exposure can be reduced by configuring an IP Filter Set to restrict access to the vulnerable endpoint ^[7]. Treat the filter as today's work and the re-deploy as this week's change request, and do not let the existence of the workaround quietly become the plan of record.

Commerce Cloud was not the only item in the August 2026 batch. SAP also addressed three other critical flaws ^[8], which makes four critical issues in one cycle by simple count ^[15]. CVE-2026-44772, rated 9.9, is a code injection issue in Manufacturing Integration and Intelligence ^[9]. CVE-2026-34265, rated 9.8, is an out-of-bounds write in Application Server ABAP for SAP NetWeaver and the ABAP Platform, where an unauthenticated attacker can exploit logical errors in DIAG protocol parsing to cause memory corruption, potentially disclosing sensitive system information or crashing the system ^[10]. CVE-2026-44758, rated 9.1, is another Manufacturing Integration and Intelligence code injection flaw, but it requires high privileges to execute arbitrary commands on the underlying operating system ^[11].

Note the ordering there: the 9.1 needs high privileges ^[11], while the 9.9 is reachable by a low-privileged attacker who submits crafted input that makes the application fetch and process attacker-controlled content from an external source, ending in arbitrary command execution on the host ^[13]. Per Onapsis, the 9.1 stems from a servlet component vulnerable to server-side template injection and server-side request forgery, and SAP's patch removes that servlet outright ^[12].

The 9.9 fix also has a configuration tail. Onapsis says that after applying the patch, customers must maintain a new system property called Secure Transformer with a list of allowed hosts for hosting XSL files, and only XSL files from those hosts can be consumed by the previously vulnerable servlet ^[14]. An allowlist that nobody populates is an outage or a false sense of safety, depending on the default.

Watch for whether the Commerce Cloud endpoint shows up in scanning traffic before customers finish re-deploying, and whether the Secure Transformer allowlist generates support noise from teams that patched without configuring it.