SAP Commerce Cloud CVE-2026-58231

Exploitation requires network reachability to the SAP Commerce Cloud Data Hub Adapter and the presence of the default authentication client, which the description states an unauthenticated attacker can abuse - meaning a deployment left with that default client enabled is exploitable without credentials. The specific prerequisite is that the Data Hub Adapter is deployed and its default authentication client is reachable; the vulnerable functions lack sufficient input validation, so a specially crafted request to those functions is the trigger. Limiting factors: the target must actually run the Data Hub Adapter component (not all Commerce deployments expose it externally), and environments that have disabled or hardened the default authentication client, or that firewall the adapter to internal-only access, materially reduce reachability. No user interaction, no authentication, and no non-default privilege level are required per the CVSS vector.

Every CVSS signal points to maximum real-world risk: AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), and S:C (scope change) with C:H/I:H/A:H combine to the ceiling score of 10.0. The presence of a reachable default authentication client removes the usual authentication barrier, and CWE-94 code injection typically enables reliable, deterministic exploitation rather than probabilistic memory-corruption. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation is not yet confirmed in the wild - but absence of a POC does not lower the intrinsic risk of an unauthenticated RCE in an internet-facing commerce platform. This is a genuine priority, not a high-CVSS-but-low-impact edge case; the scope change (S:C) indicates the vulnerable component can pivot to compromise other internal components. Missing data to note: no EPSS or SSVC automatable/technical-impact values were supplied, so probability-of-exploitation modeling cannot be quantified here.

An attacker with only network reachability to the SAP Commerce Cloud Data Hub Adapter connects using the default authentication client, requiring no valid credentials, and submits a crafted payload to a vulnerable processing function. Because the input is insufficiently validated, it is interpreted as code and executed on the server, and the scope change lets the attacker pivot from the adapter into other internal components. No public POC was identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N profile means exploitation is straightforward once the vulnerable function is understood.