SAP Commerce Cloud — CVE-2026-58231

Threat Overview

CVE-2026-58231 is a maximum-severity vulnerability in the SAP Commerce Cloud Data Hub Adapter. SAP describes the issue as improper authorization combined with insufficient input validation. An unauthenticated network attacker can abuse a default authentication client and submit specially crafted input to vulnerable functions, potentially resulting in arbitrary code execution and compromise of internal application components.

SAP assigned the vulnerability a CVSS 3.1 score of 10.0 with a network attack vector, low attack complexity, no required privileges, and no user interaction. The SAP CNA record maps the weakness to CWE-94: Improper Control of Generation of Code.

SAP released Security Note 3771065 on August 11, 2026. Defused Cyber reported exploitation attempts reaching its honeypots on August 14, 2026, only three days after Patch Day. KEV Intelligence independently reported two matching attempts from a single source on the same date. This confirms exploitation attempts against the vulnerability, although the available public reporting does not establish a broad campaign, named threat actor, or consistent post-exploitation payload.

A researcher report identifies /datahubadapter/import/** as a relevant Data Hub import path. That endpoint detail is useful for hunting but is researcher-reported and is not exposed in SAP’s public Patch Day bulletin, so it should not be treated as a guaranteed universal exploit signature.

References

Impacted Systems

Vendor	SAP
Product	SAP Commerce Cloud — Data Hub Adapter
Affected version identifiers	COM_CLOUD 2211 and 2211-JDK21
Component / role	Data Hub Adapter / Data Hub integration functionality
Attack vector	Network
Authentication required	None
User interaction	None
CVSS	10.0 Critical — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness	CWE-94 — Improper Control of Generation of Code
Potential impact	Arbitrary code execution, compromise of internal components, and high impact to confidentiality, integrity, and availability
Exposure of greatest concern	Data Hub Adapter functionality reachable from untrusted networks or the Internet
Remediation	Apply SAP Security Note 3771065 and rebuild/redeploy the updated SAP Commerce Cloud version. SAP’s public Patch Day page identifies the affected version families but does not publish exact fixed build numbers.

Why this matters

SAP Commerce Cloud commonly sits in high-value e-commerce and business-integration environments. Unauthenticated code execution in a Java application tier can provide an attacker with a foothold capable of accessing application secrets, databases, integration credentials, customer data, and connected internal services. The three-day gap between patch release and observed exploitation attempts makes exposure validation and behavioral hunting particularly important.

Exploitation Status

Confirmed exploitation attempts observed. Defused Cyber reported matching honeypot traffic beginning August 14, 2026. KEV Intelligence independently observed two attempts from one source on August 14. Public reporting does not currently provide a stable attacker IP set, universal request signature, or consistently observed post-exploitation payload suitable for relying on IOC-only detection.

What this hunt looks for

The strongest approach is behavioral. Look for suspicious requests to Data Hub Adapter paths followed by Java spawning operating-system shells, scripting engines, download utilities, or unusual executables; Java writing scripts or binaries to temporary/application directories; and new or rare outbound network connections from Java processes. The HTTP path hunt should be treated as supporting telemetry rather than the sole exploit detector.

Required logs

DeviceProcessEvents — Java child processes and post-exploitation execution
DeviceNetworkEvents — outbound network activity from Java and spawned tools
DeviceFileEvents — files created by Java or Java-spawned processes
CommonSecurityLog — WAF, reverse-proxy, firewall, or HTTP request telemetry when URL/method fields are populated
SecurityEvent — optional Event ID 4688 fallback where Windows process creation and command-line auditing are available
Syslog — optional Linux/application/web-server logging when forwarded to Sentinel

Hunt 1 — Suspicious Child Processes of SAP Java Services

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("java.exe", "java")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh", "dash", "curl", "curl.exe", "wget", "wget.exe", "certutil.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "python", "python.exe", "perl")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 2 — Rare Child Processes of Java

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("java.exe", "java")
| summarize Executions=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Devices=make_set(DeviceName,20) by FileName, ProcessCommandLine
| sort by Executions asc

Hunt 3 — Outbound Connections From Java Processes

DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("java.exe", "java")
| where RemoteIPType == "Public"
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Devices=make_set(DeviceName,20), RemoteIPs=make_set(RemoteIP,20) by RemoteUrl, RemotePort, InitiatingProcessCommandLine
| sort by Connections asc

Hunt 4 — Data Hub Adapter Import Endpoint Requests

The /datahubadapter/import/ path is researcher-reported. Validate the path against the customer’s SAP deployment before treating it as definitive.

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has "/datahubadapter/import/"
| where RequestMethod in~ ("POST", "PUT", "PATCH")
| project TimeGenerated, SourceIP, DestinationHostName, DestinationIP, RequestMethod, RequestURL, RequestClientApplication, DeviceAction, Message
| sort by TimeGenerated asc

Hunt 5 — Repeated Data Hub Import Requests From the Same Source

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has "/datahubadapter/import/"
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Methods=make_set(RequestMethod,20), UserAgents=make_set(RequestClientApplication,20), URLs=make_set(RequestURL,50) by SourceIP, DestinationHostName, bin(TimeGenerated,15m)
| where Requests >= 5
| sort by Requests desc

Hunt 6 — Java Creating Scripts, Executables, or Web Artifacts

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("java.exe", "java")
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName endswith ".sh" or FileName endswith ".ps1" or FileName endswith ".bat" or FileName endswith ".cmd" or FileName endswith ".jsp" or FileName endswith ".class" or FileName endswith ".jar" or FileName endswith ".exe" or FileName endswith ".dll"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated asc

Hunt 7 — Java Child Process Followed by Public Network Activity

let SuspiciousChildren = DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("java.exe", "java")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh", "curl", "curl.exe", "wget", "wget.exe", "python", "python.exe")
| project DeviceId, DeviceName, ProcessTime=TimeGenerated, ChildProcess=FileName, ChildCommandLine=ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteIPType == "Public"
| join kind=inner SuspiciousChildren on DeviceId
| where TimeGenerated between (ProcessTime .. ProcessTime + 10m)
| project ProcessTime, TimeGenerated, DeviceName, ChildProcess, ChildCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by ProcessTime asc

Hunt 8 — New Java Outbound Destinations Compared With Prior Baseline

let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where InitiatingProcessFileName in~ ("java.exe", "java")
| where RemoteIPType == "Public"
| summarize by DeviceId, RemoteIP, RemotePort;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("java.exe", "java")
| where RemoteIPType == "Public"
| join kind=leftanti Baseline on DeviceId, RemoteIP, RemotePort
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteUrls=make_set(RemoteUrl,20) by DeviceName, RemoteIP, RemotePort, InitiatingProcessCommandLine
| sort by FirstSeen desc

Hunt 9 — Windows Security Event 4688 Fallback for Java-to-Shell Execution

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where ParentProcessName endswith @"\java.exe"
| where NewProcessName endswith @"\cmd.exe" or NewProcessName endswith @"\powershell.exe" or NewProcessName endswith @"\pwsh.exe" or NewProcessName endswith @"\rundll32.exe" or NewProcessName endswith @"\certutil.exe"
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| sort by TimeGenerated asc

Hunt 10 — Data Hub / SAP Commerce Indicators in Syslog

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("datahubadapter", "Data Hub", "SAP Commerce", "/datahubadapter/import/")
| where SyslogMessage has_any ("POST", "PUT", "exception", "error", "Runtime", "ProcessBuilder", "exec", "bash", "powershell", "curl", "wget")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Detection Notes

Do not rely on a single request URI or attacker IP. Public exploitation reporting currently provides limited stable IOC material.
Prioritize Java-to-shell/process execution because this is a high-signal post-exploitation behavior for a Java application server.
Scope Java hunts to confirmed SAP Commerce/Data Hub servers whenever an asset inventory or watchlist is available; broad Java hunting across an enterprise can be noisy.
Correlate suspicious HTTP activity with endpoint process creation and outbound connections within a short time window.
Absence of matching HTTP requests does not rule out exploitation when the relevant WAF, reverse-proxy, or application logs are not ingested into Microsoft Sentinel.