SAP Commerce Cloud CVE-2026-58231 Critical Flaw Exploited in the Wild Just Three Days After Patch
SAP Commerce Cloud has been struck by a maximum-severity vulnerability, CVE-2026-58231, rated CVSS 10.0. The flaw permits unauthenticated remote code execution and was actively exploited in the wild only three days after the vendor released patches.
Security researchers first published exploitation traffic on 14 August, catching many organizations still digesting the August patch bulletin. SAP assigned the issue its highest priority rating, HotNews, while firms such as Onapsis placed it at the top of their remediation lists for the month.
Where the flaw resides
The vulnerability affects the Data Hub Adapter component responsible for exchanging and importing data between SAP Commerce Cloud and external systems. Attackers abuse a default authentication client that possesses excessive privileges and lacks proper input validation, effectively granting a universal access token to any reachable endpoint.
No credentials or user interaction are required; a single HTTP request is sufficient to achieve arbitrary code execution and full compromise of the application and its connected components.
Why the platform is a high-value target
SAP Commerce Cloud, formerly known as SAP Hybris, serves as the online storefront and B2B transaction layer for numerous global retailers and manufacturers. It is deeply integrated with ERP, CRM, inventory, payment, and fulfillment systems, meaning a breach can expose an entire business chain.
Scanning data from Shadowserver shows more than 4,200 internet-reachable instances worldwide, concentrated in Europe and North America, underscoring the broad attack surface.
Rapid weaponization driven by automation
Security teams observed the first exploitation attempts on 14 August, three days after the 11 August patch release. Analysts attribute the speed to automated and AI-assisted reverse engineering that quickly identifies patch differences and constructs working exploits.
This compressed timeline renders traditional quarterly patching cycles obsolete and forces organizations to treat such issues as immediate emergency events.
Immediate mitigation steps
- Upgrade to SAP Commerce Cloud 2211.55, 2211-jdk21.17 or later versions listed in security note 3771065.
- Verify that production systems are actually running the updated releases.
- Apply IP Filter Sets to restrict Data Hub Adapter endpoints to trusted sources only.
- Map all backend integrations, service accounts, and data flows to understand potential blast radius before an incident occurs.
Related articles
Automating Asset Scanning in MaxPatrol VM via API: Part 4 on Authentication
A detailed technical guide explains how to build asset scanning automation in MaxPatrol VM using its API, starting with authentication methods. The author covers three authorization options including local account login-password, domain account credentials, and reference tokens, providing working Python examples for local accounts. Code reads secrets from an .env file and obtains a Bearer token valid for 24 hours from the Core role instance. The post details required privileges in both the Management Console and MaxPatrol 10 for tasks such as vulnerability exports, dynamic asset group management, scan task creation, and report exporting. It credits Alexey Leonov for an early GitHub script that enabled practical API usage and lists additional resources including webinars, SDK, CLI, Jira integration, and a Postman collection. All subsequent API calls rely on the generated headers containing the Bearer token.
Securing Hadoop Clusters: Removing Passwords from XML Configs with Credential Provider API and JCEKS
Hadoop configurations frequently expose sensitive credentials such as database passwords and cloud access keys in plain text within files like hive-site.xml and core-site.xml. The Credential Provider API, introduced in Hadoop 2.6, allows applications to retrieve secrets from an external JCEKS keystore instead of embedding them directly in XML. This mechanism uses conf.getPassword() to fetch decrypted values from the keystore when hadoop.security.credential.provider.path is configured. JCEKS relies on the outdated PBEWithMD5AndTripleDES algorithm, which remains vulnerable to Sweet32 attacks in theory though practical risk for small keystore files is low. Master password protection for the keystore itself is the weakest link, with options including environment variables, protected password files, or HDFS Transparent Data Encryption. Arenadata has automated credential encryption management in its ADH platform through ADCM to handle keystore creation, permission setting, and rotation across cluster nodes.
CISA Adds Five Exploited Vulnerabilities to KEV Catalog Including AhsayCBS Authentication and Command Injection Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. Four vulnerabilities were registered on October 14, 2026, and one additional entry followed on October 15. Among the newly listed issues are two critical flaws affecting the AhsayCBS backup management server: CVE-2026-105133, an authentication bypass in the API, and CVE-2026-105134, a command injection vulnerability in the replication feature. When chained together, the pair allows unauthenticated remote attackers to execute arbitrary operating system commands. Vendor Ahsay has released hotfixes in versions 10.3.4.45 and 9.15.2.70 because standard patches cannot fully address the issues. The advisory also references vulnerabilities in Atlassian products and multiple network security solutions from other vendors.
Google Issues Chrome Security Update Fixing Critical Vulnerability Two Days After Previous Patch
Google has released a new set of security updates for its Chrome browser that address ten vulnerabilities, including one rated critical. The update arrives just two days after a larger patch that fixed 37 issues on October 13. The most severe flaw, tracked as CVE-2026-110922, is a use-after-free vulnerability in the Prerender feature that could allow remote code execution. The company released Chrome 155.0.8059.85 and 155.0.8059.84 for Windows and macOS, along with Chrome 155.0.8059.84 for Linux on October 15. The critical issue was reported by an external researcher on October 2. Deployment will occur gradually over the next several days to weeks.