Bottom line: SAP has patched a critical vulnerability in Commerce Cloud that has already been actively exploited since the weekend.
Last week, SAP closed a critical vulnerability in Commerce Cloud. Since the weekend, security researchers have been recording active attack attempts against unpatched systems.
SAP released a patch last week for a security vulnerability classified as critical in the Commerce Cloud platform. Already on the following weekend, security researchers observed initial attack attempts against installations that had not yet applied the patch. Details on a CVE identifier, the CVSS score, or the exact technical nature of the vulnerability are not included in the original report.
SAP Commerce Cloud is used by numerous companies in the DACH region as an e-commerce and trading platform and typically processes customer, payment, and order data. A critical vulnerability in such an exposed, often publicly accessible application poses a significant risk, especially when attackers are already actively searching for vulnerable systems shortly after the patch is released. The short time span between the patch release and the observed attacks suggests that the vulnerability was reverse-engineered or publicly analyzed.
CISOs operating SAP Commerce Cloud should promptly check whether the patch provided by SAP has already been applied and prioritize doing so if this has not yet occurred. Since the original report does not contain information on indicators of compromise or the exact attack vector, it is also advisable to review SAP’s security advisories as well as logs for unusual access since last weekend in order to detect possible compromises at an early stage.
Source: www.heise.de · Published August 17, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.