CVE-2026-58231

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3771065
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP Commerce Cloud permite a un atacante no autenticado abusar de un cliente de autenticación predeterminado y enviar entrada especialmente diseñada a ciertas funciones que carecen de validación suficiente. La explotación exitosa podría permitir la ejecución de código arbitrario y comprometer componentes internos, lo que resultaría en un alto impacto en la confidencialidad, integridad y disponibilidad de la aplicación.

Information

Published : 2026-08-11 11:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-58231

Mitre link : CVE-2026-58231

CVE.ORG link : CVE-2026-58231

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-58231", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58231", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Commerce Cloud (Data Hub Adapter)", "versions": [{"status": "affected", "version": "COM_CLOUD 2211"}, {"status": "affected", "version": "2211-JDK21"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T11:17:15.390", "references": [{"url": "https://me.sap.com/notes/3771065", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "SAP Commerce Cloud allows an unauthenticated\nattacker to abuse a default authentication client and submit specially crafted\ninput to certain functions lacking sufficient validation. Successful\nexploitation could enable arbitrary code execution and compromise internal\ncomponents, resulting in high impact on confidentiality, integrity, and\navailability of the application."}, {"lang": "es", "value": "SAP Commerce Cloud permite a un atacante no autenticado abusar de un cliente de autenticaci\u00f3n predeterminado y enviar entrada especialmente dise\u00f1ada a ciertas funciones que carecen de validaci\u00f3n suficiente. La explotaci\u00f3n exitosa podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo arbitrario y comprometer componentes internos, lo que resultar\u00eda en un alto impacto en la confidencialidad, integridad y disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cna@sap.com"}