{"id":"CVE-2026-58231","state":"PUBLISHED","title":"Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)","description":"SAP Commerce Cloud allows an unauthenticated\nattacker to abuse a default authentication client and submit specially crafted\ninput to certain functions lacking sufficient validation. Successful\nexploitation could enable arbitrary code execution and compromise internal\ncomponents, resulting in high impact on confidentiality, integrity, and\navailability of the application.","publishedAt":"2026-08-11T10:21:29.039Z","updatedAt":"2026-08-12T03:59:57.112Z","severity":{"score":10,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"sap"},"assigner":"sap","products":["SAP_SE SAP Commerce Cloud (Data Hub Adapter)"],"affected":[{"vendor":"SAP_SE","product":"SAP Commerce Cloud (Data Hub Adapter)","defaultStatus":"unaffected","versions":[{"version":"COM_CLOUD 2211","status":"affected"},{"version":"2211-JDK21","status":"affected"}]}],"references":["https://me.sap.com/notes/3771065","https://url.sap/sapsecuritypatchday"],"weaknesses":["CWE-94"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/58xxx/CVE-2026-58231.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-58231","state":"PUBLISHED","datePublished":"2026-08-11T10:21:29.039Z","dateUpdated":"2026-08-12T03:59:57.112Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2026-06-29T19:34:28.222Z"},"containers":{"cna":{"title":"Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)","descriptions":[{"lang":"en","value":"SAP Commerce Cloud allows an unauthenticated\nattacker to abuse a default authentication client and submit specially crafted\ninput to certain functions lacking sufficient validation. Successful\nexploitation could enable arbitrary code execution and compromise internal\ncomponents, resulting in high impact on confidentiality, integrity, and\navailability of the application."}],"affected":[{"vendor":"SAP_SE","product":"SAP Commerce Cloud (Data Hub Adapter)","defaultStatus":"unaffected","versions":[{"version":"COM_CLOUD 2211","status":"affected"},{"version":"2211-JDK21","status":"affected"}]}],"references":[{"url":"https://me.sap.com/notes/3771065"},{"url":"https://url.sap/sapsecuritypatchday"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":10,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","lang":"en","description":"CWE-94: Improper Control of Generation of Code","type":"CWE"}]}],"providerMetadata":{"shortName":"sap","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateUpdated":"2026-08-11T10:21:29.039Z"},"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sap_se:sap_commerce_cloud_data_hub_adapter_:com_cloud_2211:*:*:*:*:*:*:*"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap_se:sap_commerce_cloud_data_hub_adapter_:2211-jdk21:*:*:*:*:*:*:*"}]}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-11T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-58231"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-12T03:59:57.112Z"}}]}}}