SAP patched a maximum-severity flaw in its Commerce Cloud e-commerce platform on Aug. 11. Three days later, attackers were probing for it before anyone had published code showing how to exploit it.
Defused, a threat-intelligence firm that operates decoy servers to catch early attack activity, said its honeypots recordedthe first exploitation attempts against CVE-2026-58231 on Aug. 14. At the time, the vulnerability had no public proof-of-concept exploit and no prior reports of use in the wild.
The flaw sits in SAP's Data Hub Adapter, an extension used by SAP Commerce Cloud to exchange data with external systems. Per the CVE details, an unauthenticated attacker can exploit a bundled default authentication client and submit crafted input to functions that lack sufficient validation, resulting in arbitrary code execution. No credentials, no user interaction required.
Commerce Cloud runs B2B and B2C storefronts for Samsung, Mercedes-Benz, Shell, BP, and Alphabet, among others. Unfortunately, experts expect the time from a published patch to exploitation to become, if it hasn't already, the norm.
The old remediation math no longer adds up
Gunter Ollmann, chief technology officer at Cobalt, explained in an email to CYBR.SEC.Media that what's changed is how quickly reverse engineering can occur now. "Diffing a patch against the prior release used to take a skilled researcher real time and effort," Ollmann wrote. "AI-assisted code analysis tools are collapsing that timeline, letting attackers automate the comparison, spot the exact logic that changed, and generate working exploit material in a fraction of the time," he wrote.
"Three days from patch to active exploitation is no longer an outlier. It is becoming the expected timeline for critical, remotely exploitable vulnerabilities in widely deployed enterprise platforms," Ollmann continued.
Set that reality against a standard 30-day remediation window, which assumes enterprises have time to inventory affected assets, assign an owner, test, schedule, and deploy patches through normal change management, and it's easy to see the challenges enterprises will have keeping pace.
For SAP Commerce Cloud, the fix entails much more than a standard patch. Per SAP's Security Note 3771065, remediation means upgrading to version 2211.55 or 2211-jdk21.17 and then rebuilding and redeploying the environment.
If enterprises can't patch before attackers start scanning and exploiting, detection and compensating controls must mitigate the risk. That means configuring an IP Filter Set to restrict /datahubadapter/import/** to trusted Data Hub addresses during the rebuild stage.
What changes for CISOs
Unfortunately, CVE-2026-58231 isn't an exception. It's increasingly the pattern. For instance, SharePoint's CVE-2026-55040 was patched in July and exploited roughly 24 hours after Rapid7 published working PoC code on Aug. 11. While VMware vCenter's CVE-2026-59310 was disclosed July 29, QUIRSO observed confirmed compromises five days later across 361 IP addresses in 47 countries: a disclosure-to-exploit interval.
CISA added a critical Ray flaw — CVE-2025-62593, CVSS 9.4 — to its Known Exploited Vulnerabilities catalog on Aug. 17, giving federal agencies until Aug. 20 to remediate the open-source framework that underpins much of production AI and ML compute. What makes it notable is the timing: BitSight reported in March that the RondoDox botnet had weaponized the flaw two days before it was publicly disclosed on Nov. 26, 2025, working from a proof-of-concept that beat the CVE record to publication.
Ray isn't widely known, noted Eric Parizo founder and chief analyst at Cernivera Research in a recent Cernivera Newswire, it sits at the center of many AI training and inference environments. And a cluster left exposed and unpatched gives an attacker both expensive compute and a foothold in the AI pipeline. "The maintainers have long treated the missing authentication as expected behavior for software meant to run on a trusted network, which places the burden on operators to keep it off the public internet, which is often unrealistic," he wrote.
While the flaw does date back to late 2025, its KEV listing confirms sustained, real-world exploitation, Parizo said. "Cernivera recommends upgrading to Ray 2.52.0 promptly, removing Ray dashboards and job-submission endpoints from public networks, and watching GPU clusters for the unexpected outbound traffic and workload spikes that betray cryptomining."
"[With SAP] adversaries needed only 72 hours to begin probing systems that had not applied the fix, the latest sign that the gap between disclosure and exploitation has shrunk to a matter of hours," he continued. "This is the collapse in patch timelines," Parizo concluded.
