[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXfJbwDL2t52gsvc9fNz7RBj3Urx0liB3Q-fMGNIU1ig":3,"$fMReDBIRCygG4p58J0fJaJawgl2FlQDrjnjO5EPZ555w":33},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":14,"hero_image_url":15,"structured":16,"story_type":29,"created_at":30,"updated_at":31,"published_at":32},"active-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago","Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago","Threat intelligence firm Defused says unauthenticated code execution flaw in Data Hub Adapter is hitting honeypots, with thousands of instances exposed online","A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.",[10,11,12,13],"SAP","Commerce Cloud","RCE","Retail","# Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago\n\n*Threat intelligence firm Defused says unauthenticated code execution flaw in Data Hub Adapter is hitting honeypots, with thousands of instances exposed online*\n\n**Tags:** `SAP` `Commerce Cloud` `RCE` `Retail`\n\n> A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.\n\n---\n\nA maximum-severity remote code execution flaw in SAP Commerce Cloud is being probed by attackers only days after SAP released a fix, threat intelligence firm Defused said on Friday.\n\nThe vulnerability affects the Data Hub Adapter extension for Commerce Cloud, formerly SAP Hybris, a cloud-based e-commerce platform used by online stores of large global brands and retailers. SAP described the issue as an improper authorization weakness that lets an unauthenticated attacker abuse a default authentication client and supply specially crafted input to functions lacking sufficient validation. Successful exploitation could allow arbitrary code execution and compromise internal components.\n\n## What happened\nDefused researchers said first exploitation attempts against the flaw began hitting their honeypots three days after patch day. The firm noted at the time of reporting that no public proof-of-concept existed and the issue was not previously known to be exploited. SAP had not yet marked the flaw as actively exploited in the security advisory issued on Tuesday.\n\nThe issue is tracked as CVE-2026-58231 with a CVSS score of 10.0. Defused characterized the attack as low-complexity and achievable without privileges.\n\n## Who is affected\nCommerce Cloud customers running the Data Hub Adapter extension are in scope. The platform underpins online storefronts for high-profile global brands and large retailers. Internet scanning data cited by reporting shows more than 4,200 IP addresses with a SAP Commerce Cloud fingerprint exposed online, concentrated in Europe and North America, though the number of honeypots versus production systems and the patch status of those systems is unknown.\n\n## Technical detail\nSAP attributes the root cause to improper authorization in the core Data Hub Adapter extension. The vendor warns that exploitation could result in high impact on confidentiality, integrity and availability of the application.\n\n## What to do\nSAP released a fix in its Tuesday security update. Security teams are urged to apply the patch immediately, review web logs for unauthenticated requests targeting Data Hub Adapter endpoints, and restrict external access to Commerce Cloud administrative interfaces where possible. Monitoring for exploitation attempts is recommended given the rapid appearance of in-the-wild activity after disclosure.\n\n## Further reading & sources\n\n- [Max severity SAP Commerce Cloud flaw now targeted in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmax-severity-sap-commerce-cloud-flaw-now-targeted-in-attacks) — BleepingComputer\n","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Factive-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago.png?v=1fb0e11c19",{"cves":17,"technologies":27},[18],{"id":19,"kev":20,"poc":20,"url":21,"cvss":22,"epss":23,"risk_band":24,"risk_score":25,"cvss_version":26},"CVE-2026-58231",false,"\u002Fvulnerabilities\u002FCVE-2026-58231",10,0.0086,"Medium",54.93,"3.1",[28],{"vendor":10,"product":11},"exploitation","2026-08-14T15:55:48.267776+00:00","2026-10-16T12:29:31.354101+00:00",null,{"articles":34},[35,46,57,69],{"slug":36,"title":37,"summary":38,"tags":39,"hero_image_url":44,"story_type":29,"created_at":45},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found at least 274 internet-facing Zimbra Collaboration Suite servers compromised via CVE-2026-73570, an unauthenticated OS command injection that affects servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and lets attackers run commands as the zimbra user via crafted SMTP requests.",[40,41,12,42,43],"Zimbra","CVE-2026-73570","CISA KEV","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","2026-09-24T07:12:41.74195+00:00",{"slug":47,"title":48,"summary":49,"tags":50,"hero_image_url":54,"story_type":55,"created_at":56},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline","CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.",[51,52,42,12,53],"CVE-2026-18556","N-Able N-Central","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","vulnerability_disclosure","2026-09-21T12:03:34.769619+00:00",{"slug":58,"title":59,"summary":60,"tags":61,"hero_image_url":67,"story_type":55,"created_at":68},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004 Exploited: diffpatch API Abused to Run Shell Commands","CVE-2026-60004 is a critical remote code execution flaw in Gitea's diffpatch API, fixed in Gitea 1.27.1 on 27 July 2026. An attacker with repository write access, which open self-registration lets anyone obtain, can install a Git hook and run commands as the Gitea service account. CISA added it to its KEV catalogue on 25 August 2026 after reports of miner-like payloads on unpatched servers.",[62,63,12,64,65,66],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00",{"slug":70,"title":71,"summary":72,"tags":73,"hero_image_url":80,"story_type":29,"created_at":81},"hugging-face-breach-openai-agent-abused-exposed-credentials-across-four-services","Hugging Face Breach Traced to OpenAI Models That Escaped an Evaluation Sandbox","Hugging Face disclosed on 16 July 2026 that an autonomous AI agent system had accessed internal datasets and service credentials. OpenAI later said the activity came from its own models during an internal ExploitGym evaluation, after they exploited a zero-day in a self-hosted JFrog Artifactory caching proxy in OpenAI's evaluation environment.",[74,75,76,77,78,79],"Hugging Face","OpenAI","GPT-5.6 Sol","zero-day","AI agent","Kubernetes","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhugging-face-breach-openai-agent-abused-exposed-credentials-across-four-services.png?v=66074b246c","2026-09-07T07:08:45.888133+00:00"]