Defused finds SAP Commerce Cloud flaw exploited three days after patch

AI digestMimile.ai EditorialAugust 18, 2026 at 12:26 AM

This digest was compiled by AI from multiple sources — links to the originals are below.

Defused finds SAP Commerce Cloud flaw exploited three days after patch

Defused reported on Aug. 14 that CVE-2026-58231, a maximum-severity vulnerability in SAP Commerce Cloud, was exploited in the wild three days after SAP patched it on Aug. 11. Cobalt CTO Gunter Ollmann said AI-assisted code analysis is shrinking patch-to-exploit windows for critical enterprise software. The platform is used by Samsung, Mercedes-Benz, Shell, BP, and Alphabet.

Key Facts

CVE-2026-58231 was rated 10.0 on the CVSS scale and had insufficient authorization checks and input validation.
SAP patched the flaw on Aug. 11, three days before Defused posted its in-the-wild exploitation report on X on Aug. 14.
SAP Commerce Cloud customers include Samsung, Mercedes-Benz, Shell, BP, and Alphabet.
Honeypot telemetry detected exploitation before any public proof-of-concept existed, according to Cobalt CTO Gunter Ollmann.
AI-assisted code analysis tools are cutting patch-to-exploit windows from days toward minutes for some vulnerability classes, Ollmann said.

Exploitation Timeline

CVE-2026-58231, a maximum-severity flaw with insufficient authorization checks and input validation, was patched by SAP on Aug. 11. Defused posted on X on Aug. 14 that the vulnerability was exploited in the wild, three days after the patch. Honeypot telemetry detected exploitation before a public proof-of-concept existed, Cobalt CTO Gunter Ollmann said. The flaw carries a CVSS score of 10.0, the highest severity rating.

Enterprise Exposure

SAP Commerce Cloud supports complex B2B, B2C, and B2B2C online sales operations for large companies. Major businesses in automotive, technology, energy, and retail sectors run the platform, including Samsung, Mercedes-Benz, Shell, BP, and Alphabet, parent company of Google. Chris Radkowski, GRC Expert at Pathlock, said SAP environments keep getting hit with critical unauthenticated flaws because they sit at the center of business-critical data and process. Radkowski said the lesson from CVE-2026-58231 is that every SAP customer needs real-time visibility into these systems so a delayed patch or missed alert does not become a longer story.

Patch-to-Exploit Compression

Gunter Ollmann said a three-day patch-to-exploit window is becoming the expected timeline for critical remotely exploitable vulnerabilities in widely deployed enterprise platforms. AI-assisted code analysis tools let attackers automate patch diffing and generate working exploit material in a fraction of the time it once took, Ollmann said. Ollmann said patch-to-exploit windows are shrinking from days toward minutes for certain vulnerability classes, and organizations running internet-facing SAP Commerce Cloud instances should treat patch deployment as time-sensitive. Defenders waiting for a published exploit before prioritizing a fix are now working against a window measured in hours, not days, Ollmann said.

1 source

Defused finds SAP Commerce Cloud flaw exploited three days after patch

scworld.com

SC Media

Technology

SAP Commerce Cloud flaw CVE-2026-58231 draws exploitation attempts days after patch

Attempts to exploit a maximum-severity flaw in SAP Commerce Cloud began three days after the vendor released its patch, threat intelligence firm Defused Cyber reported. The vulnerability, CVE-2026-58231, carries a 10.0 CVSS rating and could allow unauthenticated attackers to execute arbitrary code and compromise internal components.

Technology

Australia Warns of Active Exploitation of Critical TeamCity Server Flaw

The Australian Cyber Security Centre (ACSC) warned that threat actors are actively exploiting a critical vulnerability in TeamCity On-Premises servers. The flaw, CVE 2026-63077, allows unauthenticated attackers to bypass authentication and execute arbitrary OS commands. All Australian organizations using TeamCity On-Premises are at risk, and the ACSC urged urgent patching.

Technology

Two Microsoft SharePoint flaws could be chained for remote code execution

Attackers are chaining two Microsoft SharePoint vulnerabilities, CVE-2026-55040 and CVE-2026-63520, to execute arbitrary code on unpatched servers, according to threat intelligence firm Defused. The company observed the exploit chain being probed in its honeypots on August 25, following the release of proof-of-concept code by Rapid7 and VulnCheck researchers. CISA has ordered federal agencies to secure their SharePoint servers against ongoing attacks.

Technology

CERT Polska warns attackers actively exploit critical Zimbra RCE flaw

CERT Polska reported Monday that threat actors are exploiting CVE-2026-73570, a critical remote code execution vulnerability in Zimbra Collaboration Suite. The flaw allows unauthenticated command injection through the SNMP monitoring component and was patched in Zimbra version 10.1.20 released July 20. Shadowserver tracks over 12,100 internet-exposed Zimbra servers, most in Europe and Asia, with no data on how many are patched.

Defused finds SAP Commerce Cloud flaw exploited three days after patch

Key Facts

Exploitation Timeline

Enterprise Exposure

Patch-to-Exploit Compression

Read more

Read more