Unauthenticated SAP Flaw Earns Maximum CVSS Score

When a vulnerability lands with a perfect 10.0 CVSS score and can be exploited by someone with no credentials at all, it tends to get attention. That's the situation SAP and its customers now face with CVE-2026-58231, a flaw in SAP Commerce Cloud's Data Hub Adapter that could let an unauthenticated attacker run arbitrary code on affected systems.

SAP released patches for the issue as part of its August 2026 security update, and security firm Onapsis is urging organizations to move quickly. The flaw isn't just theoretical — it opens the door to full compromise of internal components, which is about as bad as it gets for an enterprise application.

The vulnerability stems from the system's failure to properly check authorization and validate input. Specifically, SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions that lack sufficient validation.

A Perfect 10 and What It Allows

CVE-2026-58231 carries the maximum CVSS score of 10.0, putting it in the most severe category of vulnerabilities. The description on CVE.org explains the impact: successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

In plain terms, an attacker who can reach the vulnerable endpoint doesn't need any legitimate credentials to potentially take over the affected Commerce Cloud instance. The flaw combines insufficient authorization checks with input validation gaps, creating a path for remote code execution.

SAP has classified this as a maximum-severity issue, and the vendor's patch release is available for customers to apply. The company's advisory, which went out with the August 2026 Security Patch Day, provides the technical details and remediation guidance.

Onapsis: Patch and Re-Deploy

Onapsis, a security firm that specializes in SAP systems, has urged customers not to sit on this one. According to the company, the fix requires more than just applying the patch — customers must also re-deploy the updated SAP Commerce Cloud version to ensure the fix is actually in effect.

For organizations that can't patch immediately, Onapsis offers a temporary workaround: configure an IP Filter Set to restrict access to the vulnerable endpoint. This reduces the exposure window by limiting who can reach the affected functionality, though it's not a permanent solution.

The recommendation to patch and redeploy is a reminder that some SAP fixes need more than a simple update. In this case, the Data Hub Adapter component requires a fresh deployment of the Commerce Cloud application to fully remediate the issue.

Three More Critical Bugs in the Same Batch

SAP's August 2026 update didn't stop at Commerce Cloud. The vendor also addressed three other critical vulnerabilities, each with its own high CVSS score and distinct attack vector.

The most severe of the three is CVE-2026-44772, rated 9.9, a code injection vulnerability in Manufacturing Integration and Intelligence (MII). This one allows a low-privileged attacker to submit specially crafted input that causes the application to fetch and process attacker-controlled content from an external source, ultimately leading to arbitrary command execution on the underlying host.

Next is CVE-2026-34265, rated 9.8, an out-of-bounds write vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform. This flaw can be exploited by an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. The impact includes potential disclosure of sensitive system information or crashing the system.

Finally, CVE-2026-44758, rated 9.1, is another code injection vulnerability in Manufacturing Integration and Intelligence. This one requires high privileges but can execute arbitrary commands on the underlying operating system.

Inside the MII Vulnerabilities

Onapsis has analyzed the two Manufacturing Integration and Intelligence flaws in detail. CVE-2026-44758 involves a servlet component that is susceptible to server-side template injection (SSTI) and server-side request forgery (SSRF), which together can pave the way for command execution. The patch SAP released removes the vulnerable servlet component entirely.

For CVE-2026-44772, the fix is more nuanced. The patch addresses a vulnerable servlet that allows a low-privileged attacker to submit crafted input, causing the application to fetch and process attacker-controlled content from an external source, leading to arbitrary command execution on the underlying host.

After applying this patch, organizations have a new responsibility. Onapsis notes that customers need to maintain the new system property 'Secure Transformer' with a list of allowed hosts for hosting XSL files, because only XSL files from these hosts can be consumed by the vulnerable servlet post-patch.

Here Are the Key Details at a Glance

• CVE-2026-58231 (SAP Commerce Cloud Data Hub Adapter) — CVSS 10.0, unauthenticated arbitrary code execution
• CVE-2026-44772 (Manufacturing Integration and Intelligence) — CVSS 9.9, code injection via crafted input
• CVE-2026-34265 (Application Server ABAP for SAP NetWeaver/ABAP Platform) — CVSS 9.8, out-of-bounds write in DIAG protocol parsing
• CVE-2026-44758 (Manufacturing Integration and Intelligence) — CVSS 9.1, server-side template injection leading to command execution

These four vulnerabilities represent a significant batch of fixes from SAP's August 2026 security update, and the fact that three of them score above 9.0 on the CVSS scale makes the update urgent for anyone running affected components.

Where to Get the Fixes

SAP's patches are available through the vendor's security notes for August 2026, which customers can access via the SAP Support Portal. The company has released patches for all four vulnerabilities, and Onapsis has published its own analysis of the security patch day with additional context.

For the Commerce Cloud issue specifically, the advice from Onapsis is clear: apply the fix and then redeploy the updated version. Delaying that process leaves the door open to exploitation by unauthenticated attackers.

Why This Matters for Your Organization

The implications here are straightforward but serious. A perfect CVSS score on an unauthenticated vulnerability means that, if your SAP Commerce Cloud instance is exposed to the internet, an attacker with network access could potentially take it over without any credentials. That's a scenario that should push patching to the top of the priority list.

Even for the slightly lower-scored flaws, the picture isn't much better. Code injection and memory corruption vulnerabilities in enterprise applications like Manufacturing Integration and Intelligence can lead to full compromise of underlying systems, including the ability to execute commands at the operating system level.

This patch batch should also serve as a nudge to review your SAP security posture more broadly. The fact that multiple critical flaws shipped in a single update suggests that adversaries are actively hunting for weaknesses in these enterprise platforms, and the window between disclosure and exploitation is often short.

If you haven't already, now is the time to identify which of your SAP systems run Commerce Cloud, Manufacturing Integration and Intelligence, or Application Server ABAP, and to confirm they're on the latest patched releases. The temporary IP filter workaround for Commerce Cloud can buy time, but it's not a substitute for the full fix. As Onapsis emphasizes, patching and redeployment are essential to close these holes completely.