CVE-2026-58231: Unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter via Default Auth Client

TL;DR: SAP Commerce Cloud's Data Hub Adapter ships with a default authentication client that accepts connections without verifying credentials. An unauthenticated attacker can submit crafted input to validation-lacking functions in the adapter, achieving arbitrary code execution and full compromise of internal commerce components. No fix is available yet. The CVE was published August 11, 2026 via SAP's Security Patch Day disclosure.

Disclosure timeline and current status

SAP published CVE-2026-58231 on August 11, 2026 at 10:21 UTC as part of its August Security Patch Day cycle. The affected component is SAP Commerce Cloud (Data Hub Adapter), listed under namespace SAP_SE. The CVE record on hol.org shows fixedVersions: [], meaning no patched version has been released. Administrators running SAP Commerce Cloud with the Data Hub Adapter integration are exposed as of this writing.

This is not the first authentication failure in the Data Hub ecosystem. CVE-2026-22732, disclosed in June 2026 with CVSS 9.1, targeted a Spring Security misconfiguration in Commerce Cloud and Data Hub that similarly allowed unauthenticated access. CVE-2026-34263, disclosed in May 2026, exploited incomplete Spring Security filter chains in Commerce Cloud for unauthenticated RCE. The pattern is consistent: default or incomplete security configurations in the Data Hub and Commerce Cloud integration layer leave endpoints reachable without credentials.

What the Data Hub Adapter does

SAP Commerce Cloud, formerly known as Hybris, is an enterprise e-commerce platform serving approximately 2,500 live storefronts according to Store Leads, with IDC estimating roughly 2,800 active commerce-licensed customers. The platform is concentrated in B2B manufacturing, wholesale distribution, and DACH-region retail, where companies typically adopt it downstream of existing SAP ERP commitments.

The Data Hub Adapter is the integration bridge between SAP Data Hub and SAP Commerce Cloud. It handles data synchronization, import/export of product catalogs, and publication of impex files to the Commerce Cloud backoffice. The adapter communicates over HTTP and uses OAuth for authentication between Data Hub and the Commerce Cloud runtime. In hybris version 6.3 and later, both directions of the adapter connection use either Basic Authentication or OAuth credentials configured in local.properties.

The problem: the adapter ships with a default OAuth client and default credentials. SAP community documentation from 2017 shows the default username and password for the Data Hub connection are admin and nimbris123. While SAP documentation instructs administrators to change these, many deployments leave the defaults in place, especially in staging or lower environments that share network access with production infrastructure.

How the attack works

The CVE summary describes two compounding failures. First, the default authentication client accepts connections from any source that presents the default credentials. An attacker does not need to brute-force or leak anything. They simply submit requests as the default client. Second, certain functions in the Data Hub Adapter that process input from authenticated clients lack sufficient validation. The CVE description states that "successful exploitation could enable arbitrary code execution and compromise internal components."

The attack chain: an attacker identifies a target SAP Commerce Cloud deployment with the Data Hub Adapter exposed. They authenticate using the default client credentials. They then submit specially crafted input to one of the validation-lacking functions. The adapter processes the input without sanitizing or restricting it, executing attacker-controlled code within the Commerce Cloud runtime. The attacker gains access to the internal components: product data, customer information, order processing, and potentially the underlying application server.

The impact is rated high across confidentiality, integrity, and availability. Arbitrary code execution in the Commerce Cloud context means an attacker can exfiltrate customer and product data, modify catalog entries, inject malicious content into storefront pages, or disrupt transaction processing entirely.

Who is affected

Any SAP Commerce Cloud deployment using the Data Hub Adapter integration is potentially affected. The specific versions listed in the June 2026 SAP Security Patch Day notes for the related CVE-2026-22732 include COM_CLOUD 2211, COM_CLOUD 2211-JDK21, and DHUB_CLOUD 2211. While CVE-2026-58231 does not list specific version ranges in the hol.org record, the affected package is "SAP Commerce Cloud (Data Hub Adapter)" under namespace SAP_SE with no fixed versions published.

Deployments that have not changed the default Data Hub Adapter OAuth credentials are at the highest risk. Cloud-managed SAP Commerce Cloud 2211 instances may have the adapter enabled by default for integration workflows. On-premise deployments running hybris 2205 or earlier with Data Hub 2205 are also affected.

What to do

No patched version exists yet. Mitigation steps:

• Change the default Data Hub Adapter credentials immediately. Update datahubadapter.datahuboutbound.user and datahubadapter.datahuboutbound.password in your Commerce Cloud local.properties to strong, unique values. Do the same for the Data Hub side.
• Restrict network access to the Data Hub Adapter endpoints. The adapter typically listens on port 9002 for OAuth. Use firewall rules or SAP Cloud Platform network policies to limit access to known Data Hub and Commerce Cloud runtime IPs only.
• Disable the Data Hub Adapter if it is not in active use. If your deployment does not require Data Hub integration, remove or disable the datahubadapter extension from your Commerce Cloud extension set.
• Audit for default credentials. Check both Commerce Cloud and Data Hub installations for any OAuth clients using default or weak credentials. The SAP community thread from 2017 documents that the default credentials are admin / nimbris123.
• Monitor for the SAP patch. SAP typically releases patches on the second Tuesday of each month. Monitor SAP Note entries for CVE-2026-58231 and apply the fix as soon as it becomes available.

Why it matters

SAP Commerce Cloud processes transactions for some of the largest B2B and enterprise retail operations globally. The concentration in manufacturing and wholesale distribution means a compromise can expose supply chain pricing data, customer contact information, and order processing workflows. The default-credential attack path requires no zero-day exploit, no social engineering, and no insider access. An attacker who can reach the Data Hub Adapter endpoint and knows the default credentials (documented in public SAP community posts) can execute code on the Commerce Cloud runtime.

The knownExploited flag on the hol.org CVE record is set to false. However, the combination of documented default credentials, no available patch, and arbitrary code execution makes active exploitation likely in deployments that have not hardened their adapter configuration.

References

• CVE-2026-58231 on hol.org
• SAP Security Patch Day, June 2026
• CSA Singapore Advisory on SAP Commerce Cloud vulnerabilities
• SAP Commerce Cloud store count, Store Leads
• CVE-2026-34263: Prior Commerce Cloud Spring Security RCE