Vulnerability Management , Patch/Configuration Management Critical SAP Commerce Cloud flaw exploited days after patch August 17, 2026 Share By Steve Zurier (Adobe Stock) A maximum-severity bug in SAP Commerce Cloud was exploited in the wild, research group Defused posted on X Aug. 14. The 10.0 bug — CVE-2026-58231 — was described as having insufficient authorization checks and input validation and was earlier patched by SAP on Aug. 11. SAP Commerce Cloud helps large companies run complex B2B, B2C, and B2B2C online sales operations. Major businesses in the automotive, technology, energy, and retail sectors run the platform, including Samsung, Mercedes-Benz, Shell, BP, and Alphabet, parent company of Google. Chris Radkowski, GRC Expert at Pathlock, said SAP environments keep getting hit with critical, unauthenticated flaws because they sit at the center of so much business-critical data and process. “The lesson from CVE-2026-58231 isn't just 'patch faster,'” said Radkowski. “It's that every SAP customer needs visibility into what's happening inside these systems in real time, so a delayed patch or a missed alert doesn't turn into a much longer story.” Gunter Ollmann, chief technology officer at Cobalt, added that three days from patch to active exploitation is no longer an outlier: it’s becoming the expected timeline for critical, remotely exploitable vulnerabilities in widely deployed enterprise platforms. “What’s changing is how fast the reverse engineering happens,” said Ollmann. “Diffing a patch against the prior release used to take a skilled researcher real time and effort. AI-assisted code analysis tools are collapsing that timeline, letting attackers automate the comparison, spot the exact logic that changed, and generate working exploit material in a fraction of the time it once took. We are watching patch-to- exploit windows shrink from days toward minutes for certain vulnerability classes, and that trend will only accelerate.” Ollmann said SAP Commerce Cloud stands as a particularly attractive target because it sits at the center of ecommerce and customer transaction infrastructure, meaning a compromise can expose far more than a single server. Honeypot telemetry detecting exploitation before a public proof-of-concept existed here, which Ollmann said reinforces that sophisticated actors are moving on their own accelerated timeline, not the public research timeline. “Organizations running SAP Commerce Cloud should treat patch deployment as time sensitive rather than scheduled maintenance, and assume automated exploitation attempts are already underway against internet-facing instances,” said Ollmann. “Defenders waiting for a published exploit before prioritizing a fix are now working against a window measured in hours, not days." Steve Zurier Related Vulnerability Management Inside Mythos: A CSO’s technical decoder for Anthropic’s autonomous offensive AI Paul Wagenseil August 17, 2026 The most important aspect of Mythos isn't what it finds, but how it thinks. Here's how to use that thinking to protect your organization. Exposure management Ready for the flood: How exposure management prepares you for the Mythos vulnerability onslaught Paul Wagenseil August 14, 2026 How proactive prioritization will save time and effort when your team faces a wave of AI-discovered vulnerabilities. Vulnerability Management MacOS screen sharing vulnerability actively exploited for crypto mining SC Staff August 14, 2026 The vulnerability, identified as CVE-2026-65400, has a severity rating of 7.1 out of 10 and stems from a flaw in macOS' screen sharing capability. Related Events Cybercast State of Vulnerability Management Thu Sep 10 Cybercast Why Mythos is the cybersecurity crisis we need On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Bug Buffer Overflow Disassembly You can skip this ad in 5 seconds