Threat actors have begun actively probing and attempting to exploit a maximum-severity flaw in SAP Commerce Cloud, just three days after official security fixes were released.
Defused honeypot telemetry captured the first wave of unauthenticated remote-execution traffic circulating across the web, despite the complete absence of a public proof of concept.
Tracked as CVE-2026-58231, the security defect carries a critical CVSS score of 10.0, representing the highest possible severity rating for enterprise software. The vulnerability enables unauthenticated adversaries to execute arbitrary code remotely over the network without requiring user interaction or existing privileges.
Because SAP Commerce Cloud underpins large-scale global digital storefronts and supply chain operations, successful compromise could grant attackers full administrative control over backend databases, transaction pipelines, and sensitive enterprise assets.
Defused sensors observed the initial exploitation attempts targeting exposed application endpoints on standard web port 443. Activity logs reveal inbound attack traffic originating from hosting infrastructure tied to Charlotte Colocation Center (AS11402) in the United States, notably from the IP address 216.249.99[.]43.
Threat intelligence engines classified the initial bursts as automated mass scanning, indicating that opportunistic actors are systematically scanning internet-facing SAP deployments to identify vulnerable installations.
The rapid emergence of in-the-wild exploitation without public demonstration code indicates that threat actors likely reverse-engineered the vendor patch immediately upon release.
Enterprises running complex SAP environments frequently face prolonged patch testing cycles, creating a lucrative window of opportunity for opportunistic attackers and ransomware operators. Threat actors routinely target enterprise commerce platforms to deploy web shells, exfiltrate customer payment information, and establish persistent footholds for broader corporate network intrusions.
Security teams managing SAP deployments must treat this active threat with immediate urgency and apply the official vendor updates across all internet-facing and internal instances.
Administrators should inspect ingress web server logs and web application firewalls for anomalous POST requests directed at administrative services from external hosts.
Organizations unable to apply the update immediately should consider placing exposed management interfaces behind a virtual private network and enforcing strict access control lists to reduce attack exposure.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
