**SAP** has issued critical patches to mitigate a severe security vulnerability affecting its **Commerce Cloud (Data Hub Adapter)**. This flaw, identified as **CVE-2026-58231**, carries a maximum CVSS score of 10.0, indicating its extreme severity and potential for arbitrary code execution. ### The Apex of Vulnerability: CVE-2026-58231 The vulnerability stems from insufficient authorization checks and inadequate input validation within the **Commerce Cloud (Data Hub Adapter)**. According to the **CVE.org** description, an unauthenticated attacker could exploit a default authentication client by submitting specially crafted input to vulnerable functions. Successful exploitation of **CVE-2026-58231** could lead to arbitrary code execution, compromising internal components and severely impacting the confidentiality, integrity, and availability of the application. ### Remediation and Workarounds **Onapsis**, an **SAP** security firm, strongly advises customers to update to a fixed **Commerce Cloud** release and re-deploy the updated version immediately. As a temporary measure, organizations can reduce exposure by configuring an **IP Filter Set** to restrict access to the vulnerable endpoint. ### Additional Critical Flaws Addressed The August 2026 security update from **SAP** also addresses three other critical vulnerabilities: * **CVE-2026-44772** (CVSS score: 9.9) – A code injection vulnerability found in **Manufacturing Integration and Intelligence**. * **CVE-2026-34265** (CVSS score: 9.8) – An out-of-bounds write vulnerability affecting **Application Server ABAP for SAP NetWeaver** and **ABAP Platform**. This flaw allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, leading to memory corruption. Exploitation could disclose sensitive system information or crash the system. * **CVE-2026-44758** (CVSS score: 9.1) – Another code injection vulnerability in **Manufacturing Integration and Intelligence**, which could allow a highly privileged attacker to execute arbitrary commands on the underlying operating system. ### Deeper Dive into Other Patches **CVE-2026-44758** specifically addresses an issue within a servlet component susceptible to **Server-Side Template Injection (SSTI)** and **Server-Side Request Forgery (SSRF)**. These vulnerabilities could pave the way for command execution. **SAP's** patch for this flaw involves removing the vulnerable servlet component entirely. For **CVE-2026-44772**, the patch targets a vulnerable servlet where a low-privileged attacker can inject specially crafted input. This input can cause the application to fetch and process attacker-controlled content from an external source, ultimately resulting in arbitrary command execution on the host system. Post-patch, customers are required to maintain a new system property, 'Secure Transformer,' listing allowed hosts for XSL files. Only XSL files from these approved hosts will be processed by the servlet.