VulnerabilityBleeping Computer
10.0 — CRITICAL
Max severity SAP Commerce Cloud flaw now targeted in attacks
A maximum-severity SAP Commerce Cloud remote code execution vulnerability patched three days ago is already being targeted in attacks, according to threat intelligence company Defused. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A maximum-severity SAP Commerce Cloud remote code execution vulnerability (CVE-2026-58231) is being targeted in attacks, exploiting an improper authorization weakness that allows unauthenticated attackers to execute arbitrary code.
⚙️Technical Details
Affected Systems
SAP Commerce Cloud
Attack Vectors
NETWORK
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
High-profile global brands and large retailers using SAP Commerce Cloud
🛡️Recommended Actions
1Apply the latest security patch for SAP Commerce Cloud as soon as possible
2Monitor system logs for suspicious activity and implement intrusion detection systems
3Implement additional authentication controls to prevent exploitation of the vulnerability
📦Affected Products
Vmware Spring SecuritySAP Commerce Cloud
🔐NVD Verified DataVERIFIED
CVE-2026-58231 ↗CVSS 10 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HWeaknesses
CWE-94
CVE-2026-44761 ↗CVSS 9.1 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NWeaknesses
CWE-1392
CVE-2026-22732 ↗CVSS 9.1 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NWeaknesses
CWE-425
Affected Products (CPE)
Vmware Spring Security
CVE-2026-34263 ↗CVSS 9.6 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HWeaknesses
CWE-459
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.