[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXfJbwDL2t52gsvc9fNz7RBj3Urx0liB3Q-fMGNIU1ig":3,"$fMReDBIRCygG4p58J0fJaJawgl2FlQDrjnjO5EPZ555w":27},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":14,"hero_image_url":15,"structured":16,"story_type":24,"created_at":25,"updated_at":26,"published_at":21},"active-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago","Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago","Threat intelligence firm Defused says unauthenticated code execution flaw in Data Hub Adapter is hitting honeypots, with thousands of instances exposed online","A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.",[10,11,12,13],"SAP","Commerce Cloud","RCE","Retail","# Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago\n\n*Threat intelligence firm Defused says unauthenticated code execution flaw in Data Hub Adapter is hitting honeypots, with thousands of instances exposed online*\n\n**Tags:** `SAP` `Commerce Cloud` `RCE` `Retail`\n\n> A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.\n\n---\n\nA maximum-severity remote code execution flaw in SAP Commerce Cloud is being probed by attackers only days after SAP released a fix, threat intelligence firm Defused said on Friday.\n\nThe vulnerability affects the Data Hub Adapter extension for Commerce Cloud, formerly SAP Hybris, a cloud-based e-commerce platform used by online stores of large global brands and retailers. SAP described the issue as an improper authorization weakness that lets an unauthenticated attacker abuse a default authentication client and supply specially crafted input to functions lacking sufficient validation. Successful exploitation could allow arbitrary code execution and compromise internal components.\n\n## What happened\nDefused researchers said first exploitation attempts against the flaw began hitting their honeypots three days after patch day. The firm noted at the time of reporting that no public proof-of-concept existed and the issue was not previously known to be exploited. SAP had not yet marked the flaw as actively exploited in the security advisory issued on Tuesday.\n\nThe issue is tracked as CVE-2026-58231 with a CVSS score of 10.0. Defused characterized the attack as low-complexity and achievable without privileges.\n\n## Who is affected\nCommerce Cloud customers running the Data Hub Adapter extension are in scope. The platform underpins online storefronts for high-profile global brands and large retailers. Internet scanning data cited by reporting shows more than 4,200 IP addresses with a SAP Commerce Cloud fingerprint exposed online, concentrated in Europe and North America, though the number of honeypots versus production systems and the patch status of those systems is unknown.\n\n## Technical detail\nSAP attributes the root cause to improper authorization in the core Data Hub Adapter extension. The vendor warns that exploitation could result in high impact on confidentiality, integrity and availability of the application.\n\n## What to do\nSAP released a fix in its Tuesday security update. Security teams are urged to apply the patch immediately, review web logs for unauthenticated requests targeting Data Hub Adapter endpoints, and restrict external access to Commerce Cloud administrative interfaces where possible. Monitoring for exploitation attempts is recommended given the rapid appearance of in-the-wild activity after disclosure.\n\n## Further reading & sources\n\n- [Max severity SAP Commerce Cloud flaw now targeted in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmax-severity-sap-commerce-cloud-flaw-now-targeted-in-attacks) — BleepingComputer\n","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Factive-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago.png",{"timeline":17,"technologies":22},[18],{"date":19,"event":20,"description":21},"2026-08-14","disclosure",null,[23],{"vendor":10,"product":11},"exploitation","2026-08-14T15:55:48.267776+00:00","2026-08-18T09:49:18.382559+00:00",{"articles":28},[29,41,52,65],{"slug":30,"title":31,"summary":32,"tags":33,"hero_image_url":39,"story_type":24,"created_at":40},"attackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ","Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 Following Public PoC Release","Microsoft SharePoint is under active attack as threat actors exploit CVE-2026-55040, a critical security feature bypass with a CVSS score of 9.1, immediately after public proof-of-concept code became available.",[34,35,36,37,38],"SharePoint","CVE-2026-55040","Authentication Bypass","Active Exploitation","Microsoft Security","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fattackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ.png","2026-08-18T18:47:03.864693+00:00",{"slug":42,"title":43,"summary":44,"tags":45,"hero_image_url":50,"story_type":24,"created_at":51},"attackers-exploit-macos-screen-sharing-authentication-bypass-cve-2026-65400-to-g","Attackers Exploit macOS Screen Sharing Authentication Bypass CVE-2026-65400 to Gain Root and Deploy Monero Miners","The flaw in macOS Screen Sharing allows network-based attackers to bypass authentication and obtain root access, with observed deployments of Monero crypto miners on compromised systems.",[46,47,48,36,49],"macOS","Screen Sharing","CVE-2026-65400","Monero Miner","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fattackers-exploit-macos-screen-sharing-authentication-bypass-cve-2026-65400-to-g.png","2026-08-18T14:41:55.953675+00:00",{"slug":53,"title":54,"summary":55,"tags":56,"hero_image_url":62,"story_type":63,"created_at":64},"new-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims","New Ransomware Group Linkc Targets H2O.ai with Extortion Claims","A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.",[57,58,59,60,61],"Ransomware","H2O.ai","Data Exfiltration","Cybersecurity Threats","Extortion","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnew-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims.png","threat_actor_activity","2026-08-18T18:41:58.855449+00:00",{"slug":66,"title":67,"summary":68,"tags":69,"hero_image_url":74,"story_type":75,"created_at":76},"hunters-international-ceases-operations-announces-mass-leak-of-stolen-data-from-","Hunters International Ceases Operations, Announces Mass Leak of Stolen Data from 67 Victims","Hunters International has officially closed its project and announced it will leak stolen data from 67 victims, following a period of increased law enforcement pressure that led to its rebranding as World Leaks earlier this year.",[57,70,71,72,73],"Data Extortion","Hunters International","World Leaks","Cybercrime","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhunters-international-ceases-operations-announces-mass-leak-of-stolen-data-from-.png","ransomware_incident","2026-08-18T18:39:28.135907+00:00"]