{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58231", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-06-29T19:34:28.222Z", "datePublished": "2026-08-11T10:21:29.039Z", "dateUpdated": "2026-08-12T03:59:57.112Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-08-11T10:21:29.039Z"}, "title": "Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Commerce Cloud (Data Hub Adapter)", "versions": [{"status": "affected", "version": "COM_CLOUD 2211"}, {"status": "affected", "version": "2211-JDK21"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sap_se:sap_commerce_cloud_data_hub_adapter_:com_cloud_2211:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sap_se:sap_commerce_cloud_data_hub_adapter_:2211-jdk21:*:*:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "SAP Commerce Cloud allows an unauthenticated\nattacker to abuse a default authentication client and submit specially crafted\ninput to certain functions lacking sufficient validation. Successful\nexploitation could enable arbitrary code execution and compromise internal\ncomponents, resulting in high impact on confidentiality, integrity, and\navailability of the application.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "SAP Commerce Cloud allows an unauthenticated\nattacker to abuse a default authentication client and submit specially crafted\ninput to certain functions lacking sufficient validation. Successful\nexploitation could enable arbitrary code execution and compromise internal\ncomponents, resulting in high impact on confidentiality, integrity, and\navailability of the application."}]}], "references": [{"url": "https://me.sap.com/notes/3771065"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 10, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}, "x_gcve": [{"vulnId": "CVE-2026-58231", "recordType": "advisory"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-58231"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T03:59:57.112Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-58231", "date": "2026-11-08", "epss": "0.00855", "percentile": "0.58597"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-58231\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2026-08-11T11:17:15.390\",\"lastModified\":\"2026-10-24T16:10:00.153\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SAP Commerce Cloud allows an unauthenticated\\nattacker to abuse a default authentication client and submit specially crafted\\ninput to certain functions lacking sufficient validation. Successful\\nexploitation could enable arbitrary code execution and compromise internal\\ncomponents, resulting in high impact on confidentiality, integrity, and\\navailability of the application.\"},{\"lang\":\"es\",\"value\":\"SAP Commerce Cloud permite a un atacante no autenticado abusar de un cliente de autenticaci\u00f3n predeterminado y enviar entrada especialmente dise\u00f1ada a ciertas funciones que carecen de validaci\u00f3n suficiente. La explotaci\u00f3n exitosa podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo arbitrario y comprometer componentes internos, lo que resultar\u00eda en un alto impacto en la confidencialidad, integridad y disponibilidad de la aplicaci\u00f3n.\"}],\"affected\":[{\"source\":\"cna@sap.com\",\"affectedData\":[{\"vendor\":\"SAP_SE\",\"product\":\"SAP Commerce Cloud (Data Hub Adapter)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"COM_CLOUD 2211\",\"status\":\"affected\"},{\"version\":\"2211-JDK21\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-11T00:00:00+00:00\",\"id\":\"CVE-2026-58231\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"references\":[{\"url\":\"https://me.sap.com/notes/3771065\",\"source\":\"cna@sap.com\"},{\"url\":\"https://url.sap/sapsecuritypatchday\",\"source\":\"cna@sap.com\"}]}}", "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-58231\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-11T13:10:18.666155Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-11T14:26:17.960Z\"}}], \"cna\": {\"title\": \"Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SAP_SE\", \"product\": \"SAP Commerce Cloud (Data Hub Adapter)\", \"versions\": [{\"status\": \"affected\", \"version\": \"COM_CLOUD 2211\"}, {\"status\": \"affected\", \"version\": \"2211-JDK21\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://me.sap.com/notes/3771065\"}, {\"url\": \"https://url.sap/sapsecuritypatchday\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"SAP Commerce Cloud allows an unauthenticated\\nattacker to abuse a default authentication client and submit specially crafted\\ninput to certain functions lacking sufficient validation. Successful\\nexploitation could enable arbitrary code execution and compromise internal\\ncomponents, resulting in high impact on confidentiality, integrity, and\\navailability of the application.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"SAP Commerce Cloud allows an unauthenticated\\nattacker to abuse a default authentication client and submit specially crafted\\ninput to certain functions lacking sufficient validation. Successful\\nexploitation could enable arbitrary code execution and compromise internal\\ncomponents, resulting in high impact on confidentiality, integrity, and\\navailability of the application.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:sap_se:sap_commerce_cloud_data_hub_adapter_:com_cloud_2211:*:*:*:*:*:*:*\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:sap_se:sap_commerce_cloud_data_hub_adapter_:2211-jdk21:*:*:*:*:*:*:*\", \"vulnerable\": true}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"shortName\": \"sap\", \"dateUpdated\": \"2026-08-11T10:21:29.039Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2026-58231\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-12T03:59:57.112Z\", \"dateReserved\": \"2026-06-29T19:34:28.222Z\", \"assignerOrgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"datePublished\": \"2026-08-11T10:21:29.039Z\", \"assignerShortName\": \"sap\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}