SAP — Unauthenticated Remote Code Execution in Commerce Cloud and August 2026 Critical Patches (CVE-2026-58231)

Publication date: August 12, 2026
Category: Enterprise Security / Vulnerability

Introduction

As part of its monthly Security Patch Day for August 2026, enterprise software giant SAP released security fixes addressing several critical vulnerabilities across its product portfolio. The most severe security flaw, tracked as CVE-2026-58231, carries a maximum CVSS v3.1 rating of 10.0 and affects the Data Hub Adapter component of SAP Commerce Cloud.

This flaw enables an unauthenticated remote attacker to abuse a default authentication client and supply specially crafted input to functions lacking sufficient validation, leading to arbitrary code execution with a scope change (Scope Changed). The August security bundle also addresses three additional high-impact vulnerabilities affecting SAP Manufacturing Integration and Intelligence (MII) and SAP NetWeaver Application Server ABAP, which present vectors for code injection, memory corruption, and Server-Side Request Forgery (SSRF).

What is SAP Commerce Cloud and the Reported Vulnerabilities? (General Analysis)

SAP Commerce Cloud (formerly Hybris) is an enterprise-grade omnichannel e-commerce platform widely deployed for product catalog management, order processing, and bulk data orchestration through its Data Hub adapter. Because it handles sensitive transactional and customer data, any vulnerability allowing unauthenticated remote code execution poses a severe risk to corporate operations.

The technical breakdown and classification of the vulnerabilities addressed in this release are detailed below:

  1. CVE-2026-58231 (NVD Verified):

    • CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (Score: 10.0 - CRITICAL).
    • CWE: CWE-94 (Improper Control of Generation of Code / Code Injection).
    • Impact: Allows an unauthenticated attacker to exploit default client settings and unvalidated parameters in the Data Hub Adapter to execute arbitrary code across internal application boundaries.

  2. CVE-2026-34265 (NVD Verified):

    • CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Score: 9.8 - CRITICAL).
    • CWE: CWE-787 (Out-of-bounds Write).
    • Impact: Logic errors in the DIAG protocol parsing engine within SAP NetWeaver AS ABAP allow an unauthenticated attacker to cause memory corruption, sensitive information disclosure, or system crashes.

  3. CVE-2026-44758 (NVD Verified):

    • CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (Score: 9.1 - CRITICAL).
    • CWE: CWE-94 (Code Injection).
    • Impact: A high-privileged attacker in SAP MII can abuse vulnerable servlets via Server-Side Template Injection (SSTI) and SSRF to execute OS commands on the host machine.

  4. CVE-2026-44772 (Technical Estimation Based on Context):

    • Reported Score: 9.9 - CRITICAL.
    • Estimated Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (Reasoned estimate due to missing official NVD entry in the provided dataset).
    • Estimated CWE: CWE-91 / CWE-74 (XML Injection / Improper Neutralization).
    • Impact: Allows a low-privileged authenticated user to force the vulnerable servlet to fetch and parse external XSL files controlled by the attacker, leading to arbitrary command execution.

How Does It Work? (Technical Analysis)

Initial Infection Vector / Exploit Entry Point

For CVE-2026-58231, the vulnerability stems from an insecure default authentication client configuration within the SAP Commerce Cloud Data Hub Adapter. An attacker scans the target perimeter for exposed HTTP/HTTPS endpoints tied to the adapter’s API. Because valid user credentials and user interaction are not required, the attacker submits crafted payload structures to specific endpoints that lack strict input validation routines. The unparsed inputs are directly evaluated by the underlying framework.

In CVE-2026-44772 (SAP MII), the entry point involves a low-privileged authenticated user interacting with an exposed servlet. The attacker passes a parameter specifying a remote Extensible Stylesheet Language (XSL) file hosted on an attacker-controlled server. The SAP MII servlet processes the request without validating the remote source.

Persistence, Privilege Escalation, and Code Execution Mechanisms

  • XSL Transformation Processing: During the exploitation of CVE-2026-44772, when Java’s internal XML transformer parses the external XSL file, custom Java method calls embedded within the stylesheet are instantiated and executed. This provides arbitrary system command execution under the process context of the SAP MII service.
  • SSTI and SSRF Chaining (CVE-2026-44758): Malicious inputs delivered to the vulnerable MII servlet are parsed by a Java template engine. Combined with SSRF capabilities, attackers can bypass perimeter network restrictions and issue direct operating system commands.
  • DIAG Protocol Out-of-Bounds Write (CVE-2026-34265): The proprietary DIAG protocol used for SAP GUI communication with SAP NetWeaver AS ABAP contains a memory parsing error. Specially crafted DIAG network frames with invalid payload length headers cause the parser to write beyond the boundaries of allocated memory buffers, enabling memory corruption or daemon crashing.

C2 Infrastructure Communication and Exfiltration Methods

In scenarios involving SSRF and remote XSL resource fetching (CVE-2026-44772), the SAP application server initiates direct outbound HTTP/HTTPS connections toward the attacker’s Command-and-Control (C2) server. Beyond fetching malicious transformation files, attackers can leverage this egress channel to exfiltrate environment variables, session tokens, or local configuration files by embedding them within outbound URL parameters or request headers.

Affected Systems / Environments

The reported security flaws impact mission-critical enterprise environments running the following software components:

  • SAP Commerce Cloud: Implementations using the Data Hub Adapter connector.
  • SAP Manufacturing Integration and Intelligence (MII): Installations with active XML processing/transformation servlets.
  • SAP NetWeaver Application Server ABAP & ABAP Platform: Servers exposing DIAG protocol services to internal or external networks.
CVECategory (CWE)ImpactCVSSVector (Summary)
CVE-2026-58231CWE-94 (Code Injection)Unauthenticated remote code execution via Data Hub Adapter.10.0 (Verified)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-44772CWE-91 / CWE-74 (Estimated)Remote XSL injection leading to command execution by low-privileged users.9.9 (Estimated)*CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H*
CVE-2026-34265CWE-787 (Out-of-bounds Write)Memory corruption and DoS via DIAG protocol parser in NetWeaver AS ABAP.9.8 (Verified)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-44758CWE-94 (Code Injection)SSTI/SSRF leading to OS command execution in MII with high privileges.9.1 (Verified)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

*Note: Score reported by source; vector and CWE estimated due to missing official NVD record in the provided dataset.

Mitigation and Detection

Remediation

  1. Patch Deployment: Security teams must immediately apply SAP Security Notes 3771065 (Commerce Cloud), 3714806 (AS ABAP), and 3758900 (MII). For SAP Commerce Cloud, administrators must redeploy the updated application build after patching.
  2. Workaround for Commerce Cloud: If immediate patching is not possible, exposure should be reduced by configuring an IP Filter Set to restrict access to the Data Hub Adapter endpoint to trusted IP addresses only.
  3. Hardening SAP MII Settings: To mitigate CVE-2026-44772, administrators must configure the system property Secure Transformer with a strict whitelist of hostnames authorized to supply XSL files. For CVE-2026-44758, applying the official patch completely removes the vulnerable servlet component.

Detection

Blue Team Note: Unsanctioned outbound HTTP/HTTPS connections originating from SAP MII servers to unknown external IP addresses should be treated as high-priority Indicators of Compromise (IoCs) associated with SSRF or remote XSL stylesheet injection.

Defenders should monitor HTTP application logs and SAP system logs for anomalous patterns. The following Suricata rule can be used to detect oversized or malformed DIAG protocol packets targeting SAP NetWeaver:

solidity 
alert tcp any any -> $SAP_NETWEAVER_SERVERS 3200:3399 ( \
    msg:"SEC-RULE - SAP NetWeaver DIAG Protocol Anomalous Oversized Packet (CVE-2026-34265 Potential Exploitation)"; \
    flow:established,to_server; \
    content:"|1f 9d|"; depth:2; \
    dsize:>1460; \
    classtype:attempted-admin; \
    sid:20260812; \
    rev:1; \
)

In addition, SAP Commerce Cloud access logs should be audited for requests combining default client parameters with unvalidated input parameters.

Wrapping Up

SAP’s August 2026 security release highlights the sustained interest of threat actors in enterprise resource planning and e-commerce platforms. The maximum severity score of CVE-2026-58231 (CVSS 10.0) demands immediate remediation from security operations teams, as it opens the door to unauthenticated takeover of core enterprise environments. Combining vendor security patches with strict system property configurations (such as Secure Transformer) and perimeter IP filtering remains the most effective defense strategy.

References