cve-2026-58231

{
  "cvss": 10.0,
  "datePublished": "2026-08-11T11:17:15.390",
  "dateUpdated": "2026-10-24T16:10:00.153",
  "description": "SAP Commerce Cloud allows an unauthenticated\nattacker to abuse a default authentication client and submit specially crafted\ninput to certain functions lacking sufficient validation. Successful\nexploitation could enable arbitrary code execution and compromise internal\ncomponents, resulting in high impact on confidentiality, integrity, and\navailability of the application.",
  "id": "CVE-2026-58231",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "SAP Commerce Cloud (Data Hub Adapter)",
            "vendor": "SAP_SE",
            "versions": [
              {
                "status": "affected",
                "version": "COM_CLOUD 2211"
              },
              {
                "status": "affected",
                "version": "2211-JDK21"
              }
            ]
          }
        ],
        "source": "cna@sap.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "SAP Commerce Cloud allows an unauthenticated\nattacker to abuse a default authentication client and submit specially crafted\ninput to certain functions lacking sufficient validation. Successful\nexploitation could enable arbitrary code execution and compromise internal\ncomponents, resulting in high impact on confidentiality, integrity, and\navailability of the application."
      },
      {
        "lang": "es",
        "value": "SAP Commerce Cloud permite a un atacante no autenticado abusar de un cliente de autenticación predeterminado y enviar entrada especialmente diseñada a ciertas funciones que carecen de validación suficiente. La explotación exitosa podría permitir la ejecución de código arbitrario y comprometer componentes internos, lo que resultaría en un alto impacto en la confidencialidad, integridad y disponibilidad de la aplicación."
      }
    ],
    "id": "CVE-2026-58231",
    "lastModified": "2026-10-24T16:10:00.153",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 6.0,
          "source": "cna@sap.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-58231",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-11T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-11T11:17:15.390",
    "references": [
      {
        "source": "cna@sap.com",
        "url": "https://me.sap.com/notes/3771065"
      },
      {
        "source": "cna@sap.com",
        "url": "https://url.sap/sapsecuritypatchday"
      }
    ],
    "sourceIdentifier": "cna@sap.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-94"
          }
        ],
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ]
  },
  "severity": "CRITICAL",
  "source": "nvd",
  "title": "SAP Commerce Cloud allows an unauthenticated\nattacker to abuse a default authentication client and submit specially c..."
}