What is the CVSS score of EUVD-2026-55999?

EUVD-2026-55999 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of SAP Commerce Cloud are affected by EUVD-2026-55999?

SAP Commerce Cloud's Data Hub Adapter is vulnerable to unauthenticated remote code execution (CVSS 10.0) via a default authentication client and insufficient input validation, allowing attackers to…

Is there a public PoC exploit available for EUVD-2026-55999?

Yes, a public proof-of-concept exploit is available for EUVD-2026-55999. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate EUVD-2026-55999?

Within 24 hours: Identify all SAP Commerce Cloud instances running Data Hub Adapter and isolate them from production networks using air-gapping or strict network segmentation; disable the default authentication client if operationally feasible; enable comprehensive logging and alerting on inbound traffic to the Data Hub Adapter. Within 7 days: Conduct a full audit of network logs and system access for indicators of exploitation; deploy WAF rules to block malformed inputs targeting Data Hub Adapter endpoints; segment the Data Hub Adapter behind a zero-trust proxy requiring mutual TLS authentication. Within 30 days: Monitor SAP security advisories for an available patch; evaluate vendor-supplied workarounds or alternative architectures; develop and test an emergency patching procedure for immediate deployment when a fix is released.

SAP Commerce Cloud EUVD-2026-55999

| CVE-2026-58231 CRITICAL

Code Injection (CWE-94)

2026-08-11 sap

GHSA-686g-q5w6-7j38

RCE SAP Code Injection Sap Commerce Cloud Data Hub Adapter Sap Se

10.0

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network-reachable default auth client (PR:N/AV:N/AC:L), no interaction (UI:N), code execution pivoting to internal components justifies S:C and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 11:15 vuln.today

CVE Published

Aug 11, 2026 - 10:21 cve.org

CRITICAL 10.0

DescriptionCVE.org

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

Articles & Coverage 2

POC CVE-2026-58231: Python-Based PoC Detection and Confirmation Script Released Aug 17, 2026 News Critical RCE in SAP Commerce Cloud Data Hub Adapter - CVE-2026-58231 Aug 11, 2026

AnalysisAI

Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.

Technical ContextAI

SAP Commerce Cloud (formerly Hybris) is an enterprise e-commerce platform, and the affected component is its Data Hub Adapter - the integration layer that ingests and transforms data between external systems and the Commerce backend. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): a default authentication client is reachable pre-authentication, and certain data-processing functions accept attacker-controlled input without adequate validation, allowing that input to be interpreted as executable code rather than inert data. The affected product is identified by CPE cpe:2.3:a:sap_se:sap_commerce_cloud_(data_hub_adapter), confirming the Data Hub Adapter subsystem as the injection surface rather than the storefront itself.

RemediationAI

Apply the fix from SAP Security Note 3771065 (https://me.sap.com/notes/3771065), released under SAP Security Patch Day (https://url.sap/sapsecuritypatchday); the input does not include an exact fixed version number, so the specific patch level must be read from that note rather than assumed. Patch available per vendor advisory. As compensating controls until patching, restrict network access to the Data Hub Adapter endpoints so they are not reachable from untrusted networks (place them behind a VPN or internal segment, accepting that legitimate external integrations may break), disable or reconfigure the default authentication client referenced in the advisory to remove the unauthenticated entry point (verify downstream integrations still authenticate correctly afterward), and add WAF/input-filtering in front of the adapter to block malformed payloads (recognizing this is a partial control that a determined attacker may bypass). Do not rely on these workarounds as a substitute for the SAP note fix.