Sap on CuraSec

Max-Severity SAP Commerce Cloud RCE Exploited in Active Attacks

Sat, 15 Aug 2026 11:32:14 +0000

Engineer — Act: A max-severity RCE in SAP Commerce Cloud is under active attack just days after patching — apply the SAP patch immediately and audit Commerce Cloud logs for signs of pre-patch compromise.
SOC/IR — Act: Active exploitation is confirmed by threat intelligence, so sweep SAP Commerce Cloud application and access logs for anomalous activity indicative of RCE or post-exploitation behavior since the patch release date.
Leader — Act: Confirm whether your organization runs SAP Commerce Cloud and verify the emergency patch has been applied; if patching is delayed, request an incident status from the team given active exploitation is already underway.

Wed, 12 Aug 2026 11:57:00 +0000

Engineer — Act: Public PoC on GitHub for a CVSS 10.0 unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter makes exploitation practical now; apply SAP’s patch for CVE-2026-58231 immediately and verify no unauthorized access to the Data Hub Adapter endpoint prior to patching.
SOC/IR — Act: With a public PoC available for unauthenticated RCE, sweep web access logs for anomalous requests to SAP Commerce Cloud Data Hub Adapter endpoints and hunt for post-exploitation activity (unusual process spawns, lateral movement) on Commerce Cloud hosts since the disclosure date.
Leader — Act: Confirm whether your organization runs SAP Commerce Cloud and, if so, verify the engineering team has emergency-patched CVE-2026-58231; a public PoC for a max-severity unauthenticated RCE on an e-commerce platform warrants a same-week status check and potential customer notification if the platform handles transaction data.
Signals: CVE-2026-58231 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub

Wed, 15 Jul 2026 12:11:39 +0000

Engineer — Plan: SAP NetWeaver ABAP is widely deployed in enterprise environments and this authenticated out-of-bounds write carries a 9.9 CVSS; no KEV listing, EPSS near zero, and no public PoC mean there’s no immediate exploitation pressure, but apply SAP’s July 2026 security patches in your next maintenance window.
SOC/IR — Skip
Leader — Skip
Signals: CVE-2026-44747 — CISA KEV: not listed, EPSS 0.00, no public PoC found

Tue, 14 Jul 2026 12:08:08 +0000

Engineer — Plan: Three critical severity patches in widely deployed SAP products (NetWeaver, Commerce Cloud, AppRouter) warrant scheduling this sprint; no KEV listing or public PoC yet, but NetWeaver has been heavily targeted historically — apply July 2026 SAP Security Patch Day updates and verify no internet-exposed NetWeaver instances are lagging.
SOC/IR — Skip
Leader — Learn: Routine SAP patch cycle with critical-severity items; if SAP NetWeaver or Commerce Cloud is in the enterprise stack, confirm with engineering that the July updates are in the patching queue — no breach or active exploitation requiring leadership escalation at this time.