SAP Patches CVSS 10.0 Unauthenticated RCE in Commerce Cloud Data Hub Adapter

SAP addressed CVE-2026-58231 alongside three other critical vulnerabilities in its August 2026 update cycle. The flaw resides in the Data Hub Adapter where insufficient authorization checks allow crafted requests to trigger code execution and internal component compromise. Onapsis recommended immediate application of fixed Commerce Cloud releases followed by full redeployment. Temporary mitigation involves deploying IP Filter Sets to restrict access to the exposed endpoint.

CVE-2026-44758 and CVE-2026-44772 both affect Manufacturing Integration and Intelligence via vulnerable servlets susceptible to SSTI and SSRF. The patches remove the servlet component entirely for one issue and enforce a new Secure Transformer system property limiting XSL file sources for the other. CVE-2026-34265 introduces an out-of-bounds write in SAP NetWeaver ABAP protocol parsing that can disclose memory or crash systems.

These simultaneous disclosures reveal recurring authorization and input-handling weaknesses across SAP enterprise modules handling external data flows. Commerce and manufacturing deployments that expose default clients or unfiltered endpoints remain high-value targets given the unauthenticated attack surface and bundled critical scores.

Operators must complete patching and property reconfiguration within the next maintenance window while monitoring for anomalous requests to Data Hub endpoints. Procurement records show continued heavy investment in these platforms, increasing the blast radius of any delayed remediation.