Reported by 4 outlets

Timeline

1. original reporting

   SAP July 2026 Security Updates — Critical Flaws in NetWeaver, AppRouter, Commerce Cloud

   bleepingcomputer.com · 91d ago · July 15th, 2026

   SAP has addressed 16 vulnerabilities including three critical-severity issues. CVE-2026-44747 is a memory corruption vulnerability (out-of-bounds write) in NetWeaver Application Server ABAP enabling unauthorized data access, modification, or system unavailability for authenticated attackers. CVE-2026-27690 is an HTTP Request Smuggling vulnerability in SAP AppRouter (Node.js-based BTP middleware) enabling unauthenticated access to user responses and DoS. CVE-2026-44761 in SAP Commerce Cloud stems from default credentials allowing attackers to obtain valid access tokens and read/modify data via APIs. CISA has added 14 SAP vulnerabilities to KEV since 2021, including two abused by ransomware.

   ---

2. update from bleepingcomputer.com

   Max severity SAP Commerce Cloud flaw now targeted in attacks

   bleepingcomputer.com · 60d ago · August 14th, 2026

   A maximum-severity SAP Commerce Cloud remote code execution vulnerability patched three days ago is already being targeted in attacks, according to threat intelligence company Defused. Commerce Cloud (formerly known as SAP Hybris) is a cloud-based e-commerce platform used by online stores owned by high-profile global brands and large retailers. Tracked as CVE-2026-58231 , this critical flaw stems from an improper authorization weakness in the core Data Hub Adapter extension for Commerce Cloud that threat actors without privileges can exploit in low-complexity attacks to execute arbitrary code. "SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation," SAP explains. "Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application." While SAP has yet to flag this security flaw as actively exploited in a security advisory issued this Tuesday, Defused security researchers confirmed earlier today that CVE-2026-58231 is now being targeted in the wild. CVE-2026-58231 exploitation attempt (Defused) ​"First exploitation attempts against CVE-2026-58231 (unauth RCE in SAP Commerce Cloud, CVSS 10.0) is now hitting our honeypots - 3 days after patch day," Defused warned in a Friday tweet. "This vulnerability has no public PoC and is not known

3. update from gbhackers.com

   Critical SAP Commerce Cloud RCE Vulnerability Actively Exploited in the Wild

   gbhackers.com · 57d ago · August 17th, 2026

   The activity was detected in the company’s honeypots on August 14, just three days after SAP released its patch, according to a post by the firm’s @DefusedCyber account. If confirmed independently, these sightings would […] The post Critical SAP Commerce Cloud RCE Vulnerability Actively Exploited in the Wild appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   Hackers Exploit Attempts Target Critical SAP Commerce Cloud RCE Flaw

   cyberpress.org · 57d ago · August 17th, 2026

   Threat actors have begun actively probing for a maximum-severity vulnerability in SAP Commerce Cloud only three days after security updates were released, signaling an urgent risk for organizations operating internet-exposed commerce environments. The vulnerability, tracked as CVE-2026-58231, has received a CVSS severity score of 10.0, the highest possible rating for an enterprise software flaw. The issue could allow unauthenticated attackers to execute arbitrary code remotely over a network, without valid credentials, user interaction, or prior access to the affected environment. The activity emerged despite the apparent absence of a publicly released proof-of-concept exploit, suggesting attackers may have analyzed the vendor’s patches to identify the underlying vulnerable code path. The rapid transition from disclosure to active scanning highlights the operational challenges faced by enterprises using complex SAP ecosystems. Organizations often require extended testing periods before deploying updates to production systems, particularly when SAP Commerce Cloud supports customer-facing storefronts, payment workflows, inventory processes, and integrated supply chain operations. That delay can create a valuable opportunity for opportunistic attackers.

5. mentioned by securityweek.com

   Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure

   securityweek.com · 57d ago · August 17th, 2026