A critical vulnerability in SAP Commerce Cloud, tracked as CVE-2026-58231, is being actively exploited shortly after public disclosure, with reports indicating exploitation begins within days of the issue being reported. The flaw can allow an attacker to execute arbitrary code and compromise internal components.
Multiple outlets describe the bug as having a maximum severity rating, with CVSS scoring reported as 10.0. The Hacker News report adds detail that the vulnerability involves insufficient authorization checks and input validation, and that an unauthenticated attacker can abuse a default authentication client to submit crafted requests.
Outlets differ in emphasis: SecurityWeek focuses on the speed of observed exploitation after disclosure, while other coverage centers on the technical nature of the weakness and its impact. SecurityWeek also frames the issue as enabling access to internal components, while other accounts highlight how authentication and validation weaknesses drive the compromise. All accounts agree the vulnerability is high severity and is already under exploitation attempts.
