Critical

SAP Commerce Cloud CVE-2026-58231 Exploited in the Wild

Security Affairs

August 15, 2026 at 5:14 PM

Actively Exploited

Overview

A serious vulnerability in SAP Commerce Cloud, identified as CVE-2026-58231, is currently being exploited by attackers. This flaw, which has a maximum severity score of 10.0, arises from insufficient authorization checks and poor input validation. Just days after SAP issued a patch, reports of active exploitation began to surface. This puts organizations using SAP Commerce Cloud at risk, as attackers could potentially gain unauthorized access to sensitive information or systems. Companies should prioritize applying the latest updates from SAP to protect their environments from these attacks.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: SAP Commerce Cloud versions affected by CVE-2026-58231
Action Required: Users should apply the patch released by SAP immediately to address CVE-2026-58231.
Timeline: Newly disclosed

Original Article Summary

Attackers are actively exploiting a maximum severity SAP Commerce Cloud vulnerability, tracked as CVE-2026-58231, just days after SAP released a patch. A critical SAP Commerce Cloud vulnerability, tracked as CVE-2026-58231 (CVSS score of 10.0), is under active exploitation just days after SAP released a patch. The flaw stems from insufficient authorization checks and input validation. […]

Impact

SAP Commerce Cloud versions affected by CVE-2026-58231

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should apply the patch released by SAP immediately to address CVE-2026-58231. Specific patch numbers or versions were not provided, but organizations should check for the latest updates from SAP.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Patch, and 1 more.

Read Original Article

Related Coverage

APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2

Security Affairs

Researchers at Acronis have identified a new espionage operation known as PATCHCORD, which targets telecommunications and infrastructure in Afghanistan and South Asia. This stealthy backdoor is delivered through fake VPN tools and utilizes Google Sheets as a command and control (C2) channel. The operation appears sophisticated, using common tools in deceptive ways to evade detection. The implications of this threat are significant, as it could compromise sensitive data and operations in a region already facing security challenges. Understanding the tactics used in PATCHCORD can help organizations better defend against such targeted attacks.

Aug 16, 2026

Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware

Security Affairs

Attackers are increasingly purchasing expired domain names to take advantage of their established online reputation and traffic. These domains, referred to as dropcatch domains, can be exploited for malicious purposes, including distributing malware, conducting scams, and setting up command-and-control (C2) infrastructure. Each day, around 65,000 domain names that have lapsed are re-registered by new owners, which presents a significant risk. This trend poses dangers to users and organizations as they may unwittingly interact with these compromised domains, leading to potential security breaches. Awareness of this tactic is crucial for internet users and companies to mitigate risks associated with these expired domains.

Aug 15, 2026

New Evooo1Bot Linux botnet turns routers into traffic relay nodes

BleepingComputer

A new botnet named Evooo1Bot has emerged, targeting internet-facing routers and other gateway devices. Based on the Mirai malware, this botnet converts these devices into SOCKS5 traffic relay nodes, allowing attackers to route internet traffic through them. This can enable various types of malicious activities, including distributed denial-of-service (DDoS) attacks. The attack affects any vulnerable Linux-based routers or similar devices that are exposed to the internet, making it crucial for users and network administrators to secure their devices against unauthorized access. As the botnet continues to spread, it poses a significant risk to network integrity and privacy.

Aug 15, 2026

How To Prevent The Scaling Of Identity Fraud In Online Gaming

Cyber Defense Magazine

The online gaming industry is facing a growing problem with identity fraud as it attracts both millions of legitimate players and skilled fraudsters. Recently, two men were charged for exploiting vulnerabilities within this sector. Their actions underline the risks that gamers face, including unauthorized account access and financial theft. As fraudsters become more sophisticated, it’s crucial for gaming companies and players alike to implement stricter security measures. This includes better identity verification processes and increased awareness about phishing scams, which can help protect users from falling victim to these scams.

Aug 15, 2026

GeoServer Zero-Day Is Already Being Probed. That’s the Problem

Security Affairs

GeoServer is currently facing a serious security issue due to an unpatched zero-day vulnerability that allows for SQL injection and potentially remote code execution (RCE). This flaw has already attracted the attention of attackers who are probing exposed systems, raising concerns for organizations using this open-source geospatial platform. A security researcher named q1uf3ng disclosed the vulnerability, but as of now, there is no available patch to fix it. Companies running GeoServer should immediately assess their systems for exposure to this vulnerability and take steps to secure their installations. The urgency of the situation is heightened by the active exploitation attempts underway, making it crucial for users to act quickly to protect their data.

Aug 15, 2026

Trezor confirms shipping partner data breach affecting over 13,000 customers

SCM feed for Latest

Trezor has confirmed a data breach involving its shipping partner, affecting over 13,000 customers. Initially, it was thought that only recent orders were compromised, but new information indicates that older orders may also be at risk. This breach raises concerns about the potential exposure of personal information, which could lead to phishing attacks or other forms of identity theft. Trezor is advising customers to remain vigilant and take steps to secure their accounts. The incident highlights the vulnerability of third-party partnerships in the cryptocurrency space, emphasizing the need for companies to ensure the security of their supply chains.

Aug 14, 2026