Vulnerabilities Exploited Within Days of Disclosure: SAP Commerce Cloud and Adobe Commerce
NEOSEC enrichment — no mirror of the original source
Threat actors have begun exploiting a critical code injection vulnerability in SAP Commerce Cloud just three days after the flaw was disclosed. The vulnerability, CVE-2026-58231, CVSS score 10.0, "allows an unauthenticated attacker to abuse
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Murray, Neely, Skoudis.
Linked advisories
- CVE-2026-58231SAP Security Note 3771065
- CVE-2026-58231SAP Patch Day August 2026: Mehrere Schwachstellen
- CVE-2026-58231SAP Commerce Cloud (Data Hub Adapter): Code-Injection
- CVE-2026-71362Adobe Commerce: fehlerhafte Autorisierung
- CVE-2026-71362Adobe Commerce and Magento — Adobe Commerce and Magento Incorrect Authorization Vulnerability
- CVE-2026-71362Adobe Security Bulletin APSB26-92 — Magento
- CVE-2026-71362Adobe Magento: Mehrere Schwachstellen
- CVE-2026-58231SAP Commerce Cloud ermöglicht es einem unauthentifizierten Angreifer, einen Standard-Authentifizierungsclient zu missbrauchen und speziell g...
More on Within
Other advisories
- Not ratedosv:CLEANSTART-2026-WP85134malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
- Not ratedosv:CLEANSTART-2026-CD52607Within HostnameError
- HighCVE-2026-111768MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
- Not ratedCVE-2026-111768MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
- Not ratedosv:CLEANSTART-2026-WM37561Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL
- Not ratedosv:CLEANSTART-2026-AN49609Within HostnameError
- Not ratedosv:CVE-2026-104105FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)
- Not ratedosv:CLEANSTART-2026-OF55498malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Other news entries
- Machine speed attacks require machine speed detection and responseNewsBleepingComputer
- Microsoft: Treat AI agents as insider threatsNewsCSO Online
- High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7NewsSecurityWeek
- Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare IntrusionNewsThe Hacker News
- Security patches need patches now that attackers have AINewsThe Register — Security
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesNewsThe Hacker News
- Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on RoutersNewsThe Hacker News
- Anthropic conjures another threat that doesn't exist yet to stoke fears of AI apocalypseNewsThe Register — Security
ID