SAP Commerce Cloud (Data Hub Adapter, all versions prior to patch)
An enterprise e-commerce platform used by large retailers and manufacturers to manage online storefronts, product catalogues, and customer data.
Root Cause
SAP's Data Hub Adapter ships with a default authentication client that fails to enforce proper access controls. Functions downstream of that client do not validate the input they receive, meaning an unauthenticated request can reach and trigger code execution directly. Source: The Hacker News.
Attack Vector
An attacker with network access to the endpoint sends specially crafted input through the default authentication client, bypassing authorisation entirely. Because the affected functions lack validation, that input reaches execution-level components. No credentials are needed. The attacker gains the ability to run any command on the host system.
Detection Notes
Look for unexpected outbound connections from the Commerce Cloud host. Review authentication logs for requests hitting Data Hub Adapter endpoints from unknown sources. Alert on processes spawned by the Commerce Cloud service account that do not match normal application behaviour.
Recommended Actions
- Apply SAP's August 2026 patch and redeploy the updated Commerce Cloud version immediately.
- As a temporary measure until patching is complete, configure an IP Filter Set to restrict access to the vulnerable endpoint to trusted sources only.
- Review network exposure — this endpoint should never be reachable from the public internet.