SAP and Lazarus raise cyber alarms

SAP Commerce Cloud users face an unusually severe patching priority after disclosure of CVE-2026-58231, a flaw rated CVSS 10.0. The bug can let unauthenticated attackers execute arbitrary code, the most dangerous class of enterprise application vulnerability because it may allow takeover before login controls, fraud checks or monitoring rules engage. Patches are available, but commerce stacks often connect to payment systems, inventory databases, customer profiles and marketing tools, making delayed remediation risky. For large retailers and manufacturers, the incident is a reminder that cloud-branded business software still requires urgent vulnerability management and dependency visibility.

Sources from the briefing

• SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary CodeThe Hacker News RSS