SAP Fixes Critical Commerce Cloud RCE and MII Flaws

As part of its August security update, SAP fixed four critical vulnerabilities, the most severe of which — CVE-2026-58231 in SAP Commerce Cloud (Data Hub Adapter) — received the maximum CVSS score of 10.0. The vulnerability allows an unauthenticated attacker to execute arbitrary code by abusing the default authentication client and insufficient input validation. Organizations using SAP Commerce Cloud must apply the update immediately and redeploy the platform.

CVE-2026-58231: unauthenticated remote code execution

According to the description in the CVE registry, the root cause of the vulnerability is insufficient authorization checks combined with a lack of input validation. SAP Commerce Cloud allows an unauthenticated attacker to leverage the default authentication client and pass specially crafted data to functions that do not perform proper validation. Successful exploitation results in arbitrary code execution and compromise of internal components, with full impact on the confidentiality, integrity, and availability of the application.

The maximum CVSS score of 10.0 is driven by a combination of factors: the attack can be carried out remotely, requires no authentication or privileges, and its consequences affect all three core security properties. At the time of publication, none of the vulnerabilities in the August update had been added to the CISA KEV catalog, and there were no reports of confirmed exploitation in real-world attacks.

Three additional critical vulnerabilities

In addition to CVE-2026-58231, SAP addressed three more vulnerabilities with scores ranging from 9.1 to 9.9:

• CVE-2026-44772 (CVSS 9.9) — code injection in Manufacturing Integration and Intelligence. According to researchers at Onapsis, a vulnerable servlet allows a low-privileged attacker to pass specially crafted data that forces the application to load and process content from an external server controlled by the attacker, ultimately leading to arbitrary command execution on the host.
• CVE-2026-34265 (CVSS 9.8) — out-of-bounds write outside the allocated buffer in the Application Server ABAP for SAP NetWeaver and ABAP Platform. An unauthenticated attacker can exploit logical flaws in DIAG protocol parsing, resulting in memory corruption. Consequences include disclosure of sensitive system information or denial of service.
• CVE-2026-44758 (CVSS 9.1) — code injection in Manufacturing Integration and Intelligence. The vulnerable servlet component is reported to be susceptible to server-side template injection (SSTI) and server-side request forgery (SSRF), opening a path to operating-system-level command execution. Exploitation requires high privileges.

Impact assessment

SAP Commerce Cloud is an e-commerce platform widely used in retail, manufacturing, and the B2B sector. The CVE-2026-58231 vulnerability, enabling unauthenticated remote code execution, poses a direct threat to organizations whose Commerce Cloud instances are accessible from the internet. Compromise can lead to complete takeover of the application, leakage of customer and transactional data, and use of the compromised infrastructure as a foothold for further movement within the corporate network.

The two vulnerabilities in Manufacturing Integration and Intelligence (CVE-2026-44772 and CVE-2026-44758) are particularly dangerous for industrial enterprises, where this module integrates production systems with SAP’s ERP layer. The CVE-2026-34265 vulnerability in the ABAP platform affects a fundamental component on which most SAP installations run.

Remediation recommendations

Remediation priority — in descending order of CVSS score:

1. CVE-2026-58231 (Commerce Cloud): update to the fixed version of SAP Commerce Cloud and perform a full redeployment. According to the Onapsis recommendations, as a temporary measure until the patch is applied, you should configure a set of IP filters to restrict access to the vulnerable endpoint.
2. CVE-2026-44772 (MII, CVSS 9.9): after installing the patch, configure the new Secure Transformer system property by specifying an allowlist of hosts permitted to host XSL files. Only files from hosts on this list will be processed by the fixed servlet.
3. CVE-2026-34265 (ABAP/NetWeaver, CVSS 9.8): apply the corresponding SAP security note. Given that exploitation is possible without authentication via the DIAG protocol, verify the network exposure of DIAG ports from untrusted segments.
4. CVE-2026-44758 (MII, CVSS 9.1): install the patch, which reportedly removes the vulnerable servlet component entirely. Despite the requirement for high privileges, the presence of SSTI and SSRF makes this vulnerability dangerous if a privileged account is compromised.

Four critical vulnerabilities with scores ranging from 9.1 to 10.0 in a single monthly update represent an unusually high concentration for an SAP Patch Day. Organizations should treat deployment of these patches as an emergency task, without waiting for a scheduled maintenance window, especially for CVE-2026-58231 in Commerce Cloud, where the lack of authentication required for exploitation makes the vulnerability an attractive target for automated scanning and attacks.