SAP patched a perfect-10 bug in its store software. Hackers cracked it in 3 days flat
CVE-2026-58231 scores a maximum 10.0 — and honeypots caught real exploitation attempts before most companies even applied the fix.
Aliteq
Priya Nair · Software & Systems Editor
CVE-2026-58231 is a maximum-severity (CVSS 10.0) flaw in SAP Commerce Cloud, patched August 11, 2026.
Real exploitation attempts were logged by honeypot firm Defused Cyber and threat-intel platform KEVIntel starting August 14 — three days after the patch shipped.
The bug lets an unauthenticated attacker abuse a default authentication client and send malformed input to functions that don't validate it properly, leading to arbitrary code execution.
No public proof-of-concept exists; researchers believe attackers reverse-engineered the fix directly from SAP's own patch.
SAP's guidance includes an IP Filter Set workaround for anyone who can't patch immediately.
My honest read
I think the three-day gap here is the real story, not the 10.0 score. CVSS 10 gets a headline regardless. What should actually change how security teams operate is that a maximum-severity SAP patch…
Aliteq
Read the full story
SAP patched a perfect-10 bug in its store software. Hackers cracked it in 3 days flat