Critical SAP Commerce Cloud RCE Vulnerability Actively Exploited in the Wild

Defused observed probing/exploitation attempts against CVE-2026-58231 (a critical, unauthenticated RCE in SAP Commerce Cloud, CVSS 10.0) in its honeypots on August 14, days after SAP released a patch. The report warns that unauthenticated RCE on internet-exposed instances enables attackers to run commands, deploy web shells, exfiltrate data, or stage ransomware, and it recommends urgent patching, reducing public exposure, telemetry-driven hunting, log preservation, and blocking of confirmed indicators even though no public proof-of-concept or confirmed vendor compromise has been reported.