---
cve: "CVE-2026-58231"
severity: "CRITICAL"
cvss: 10.0
epss: "73%"
vendor: "SAP_SE"
kev: false
exploited: false
published: "2026-08-11 11:17:15"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-09-10T20:40:40+02:00"
---

# CVE-2026-58231

> 10.0 CRITICAL

## Beschreibung

SAP Commerce Cloud allows an unauthenticated
attacker to abuse a default authentication client and submit specially crafted
input to certain functions lacking sufficient validation. Successful
exploitation could enable arbitrary code execution and compromise internal
components, resulting in high impact on confidentiality, integrity, and
availability of the application.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Referenzen

- <https://me.sap.com/notes/3771065>
- <https://url.sap/sapsecuritypatchday>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-58231) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_