Performance is on everyone's mind, but third-party services are often forgotten. Can't caching be enabled for some of them?

SAP hat in der vergangenen Woche eine kritische Lücke in Commerce Cloud geschlossen. Seit dem Wochenende wird sie angegriffen.

✓ Learn how the critical SAP Commerce Cloud flaw could impact businesses and why security awareness, phishing training, and human risk management matter.

A podcast series where I'll connect with Trailblazers from the Salesforce CRM ecosystem to inspire those wanting to seek a new career path or those wanting to firm up their current career plans and…

Defused Cyber's honeypot systems read more about SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch

 A maximum-severity vulnerability in SAP Commerce Cloud is reportedly facing exploitation attempts only days after SAP released a security update. Tracked as CVE-2026-58231, the flaw carries a CVSS score of 10.0 and affects the platform’s Data Hub Adapter component. Its rapid targeting highlights the risks organizations face when internet-facing enterprise software remains unpatched.  The vulnerability stems from insufficient authorization checks and inadequate input validation. According to the vulnerability description, an unauthenticated attacker can abuse a default authentication client and submit specially crafted input to functions that do not properly validate requests. Successful exploitation could allow arbitrary code execution and enable attackers to compromise internal components, potentially affecting the confidentiality, integrity, and availability of affected Commerce Cloud environments.  Threat intelligence company Defused Cyber reportedly observed exploitation attempts against its honeypot systems approximately three days after the patch was released. However, the company stated that the activity did not include a publicly available proof-of-concept and that confirmed exploitation in customer environments had not been established at the time of reporting. Even so, the short gap between patch availability and attack activity demonstrates how quickly threat actors can reverse-engineer or operationalize information about critical enterprise vulnerabilities.  SAP security specialists have urged customers to treat the issue as an emergency. Organizations using the affected Commerce Cloud release should apply the fixed version identified in SAP’s security guidance, rebuild the updated application, and redeploy it. Simply installing a component update may not be sufficient if the deployment process requires rebuilding and publishing a refreshed Commerce Cloud version. Administrators should also review logs, authentication activity, unusual requests, and unexpected changes to internal services for possible indicators of compromise.  If immediate patching is not possible, organizations can temporarily reduce exposure by configuring an IP Filter Set to restrict access to the vulnerable endpoint. Network controls should be considered only as a short-term mitigation, not a replacement for the official update. Security teams should identify all internet-facing SAP Commerce Cloud instances, confirm their versions, limit unnecessary access, and increase monitoring around the Data Hub Adapter. Previous attacks against critical SAP products, including NetWeaver, show that criminal and espionage groups have targeted SAP flaws for code execution, persistence, and data theft.

A maximum-severity SAP Commerce Cloud remote code execution vulnerability patched three days ago is already being targeted in attacks, according to threat intelligence company Defused.

SAP has addressed 16 vulnerabilities across multiple products as part of its July 2026 security updates, including three critical flaws in NetWeaver, Commerce Cloud, and AppRouter.

SAP’s June 2026 Security Patch package fixes 15 vulnerabilities, including four critical flaws in SAP NetWeaver and SAP Commerce Cloud that could enable authentication bypass, memory corruption, and directory traversal attacks. Organizations using these products should prioritize patching CVE-2026-44748 and CVE-2026-27671 due to their high severity and potential impact on enterprise environments. #SAPNetWeaver #SAPCommerceCloud #CVE-2026-44748 #CVE-2026-27671