Cyber Threat Brief — August 16 2026
⚠️ This report is AI-generated. Always validate findings.
1. SAP Commerce Cloud Pre-Auth RCE via Data Hub Adapter — CVE-2026-58231
TL;DR: A CVSS 10.0 unauthenticated RCE in SAP Commerce Cloud’s Data Hub Adapter is being exploited in the wild — attackers reverse-engineered the August 11 patch within 3 days with no public PoC available.
What’s New:
- Improper authorization (CWE-863) in Data Hub Adapter allows unauthenticated abuse of a default authentication client to reach functions with insufficient input validation, leading to RCE
- Defused confirmed exploitation hitting honeypots starting August 14 — 3 days after SAP Security Patch Day
- No public PoC exists; attackers likely patch-diffed SAP Security Note 3771065
- Affects SAP Commerce Cloud COM_CLOUD 2211 and COM_CLOUD 2211-JDK21
- Fixed in Commerce Cloud 2211.55 / 2211-jdk21.17; temporary mitigation: restrict
/datahubadapter/import/**to approved Data Hub IPs
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST requests to /datahubadapter/import/** from unauthorized IPs | Exploit | T1190 | WAF, reverse proxy, SAP access logs | Block endpoint to non-Data-Hub sources immediately |
| Default authentication client abuse (unauthenticated API calls) | Exploit | T1078.001 | SAP Commerce application logs | Hunt for unauthenticated import requests in app logs |
| Unusual application errors or command execution after import requests | Post-exploit | T1059 | SAP Commerce error logs, OS process logs | Alert on application-server child processes post-import |
| Outbound connections from Commerce Cloud application tier | C2/exfil | T1071.001 | Network flow, firewall logs | Baseline and alert on anomalous outbound from app servers |
| Unpatched SAP Commerce Cloud 2211 instances | Vuln | — | Asset inventory | Apply Security Note 3771065 and redeploy |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | Need SAP Commerce Data Hub Adapter endpoint abuse detection; no SAP-specific content |
| Elastic | None | No SAP Commerce rules; need WAF log correlation for /datahubadapter/import anomalies |
| Sigma | None | Need web application rule for unauthenticated SAP Commerce import API access |
Sources: BleepingComputer · The Hacker News · Field Effect · SOCRadar
Status Updates
- CVE-2026-50656 (ShieldBreak/Defender bypass): Still UNPATCHED. Microsoft acknowledged but no fix timeline. ShieldBreak PoC bypasses July patch using Cloud Filter API callbacks — entirely different technique from original RoguePlanet. 100% success on Win11 25H2 and Server 2025. WDAC/AppLocker primary mitigation. Aug 13 brief.
- CVE-2026-59310 (vCenter Syslog): Mass exploitation ongoing — 361 victims across 47 countries per QUIRSO. Reverse_ssh persistence via cron jobs. Exploitation began August 3, 343 of 361 compromised by August 5. Patch immediately. Aug 13 brief.
- CVE-2026-55040 / CVE-2026-63520 (SharePoint RCE chain): Active exploitation ongoing since August 12 after Rapid7 PoC. 8,500+ on-prem servers internet-exposed. Apply both July and August CUs. Aug 14 brief.
- CVE-2026-68820 (Windows WinSock/Lazarus): CISA KEV deadline August 25. Lazarus FudModule v3.1 rootkit targeting defense/aerospace via Dream Job campaign. Aug 14 brief.
- CVE-2026-72898 (Metabase SQLi): CISA KEV deadline passed August 14. 5 companies breached pre-disclosure including Framework and Anaconda. ~2,500 exposed instances. Aug 12 brief.
- CVE-2026-58231 (SAP Commerce Cloud): NEW — see full section above.