SAP Commerce Cloud CVE-2026-58231 Requires Urgent Patching

SAP has released an urgent advisory for CVE-2026-58231, a critical (CVSS 10.0) improper-authorization vulnerability in the SAP Commerce Cloud Data Hub Adapter that can enable unauthenticated remote arbitrary code execution; affected branches include COM_CLOUD 2211 and COM_CLOUD 2211-JDK21 and organizations should apply SAP Security Note 3771065, redeploy corrected releases, verify running versions, restrict external access to the Data Hub import endpoint, and review logs and credentials—exploitation attempts have been observed in honeypots but no confirmed successful exploit or public proof-of-concept has been published.