# SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities (CVE-2026-58231, CVSS 10.0)

> SAP's August 11, 2026 Security Patch Day shipped 28 new security notes, 2 updates, and 1 GitHub security advisory, including four critical-severity fixes. CVE-2026-58231 (CVSS 10.0) is an improper-authorization/code-injection flaw in SAP Commerce Cloud's Data Hub Adapter that lets an unauthenticated attacker abuse a default authentication client to reach unvalidated functions and internal components, likely achieving code execution. CVE-2026-44772 (CVSS 9.9) and CVE-2026-44758 (CVSS 9.1) are code-injection flaws in Manufacturing Integration and Intelligence (MII) that let a high-privileged attacker submit crafted input to run arbitrary OS commands on the host. CVE-2026-34265 (CVSS 9.8) is an unauthenticated memory-corruption bug in NetWeaver/ABAP Platform's Application Server ABAP, rooted in DIAG protocol parsing, that can disclose sensitive data or crash the system.

- **Published:** 2026-08-11T00:00:00Z
- **Last reviewed:** 2026-08-16T00:06:10.793Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1984
- **ID:** TL-2026-1984
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-58231, CVE-2026-44772, CVE-2026-44758, CVE-2026-34265

## Description

On August 11, 2026, SAP's monthly Security Patch Day released 28 new security notes, 2 updates to prior notes, and 1 GitHub security advisory. Four of the new notes are rated critical.

The most severe, CVE-2026-58231 (CVSS v3.1: 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-94 Improper Control of Generation of Code / Code Injection, per NVD's published record), affects the Data Hub Adapter component of SAP Commerce Cloud (COM_CLOUD 2211 and 2211-JDK21). An unauthenticated remote attacker can abuse a default authentication client and submit specially crafted input to functions that lack sufficient validation, bypassing authorization to reach internal components and likely execute arbitrary code. SAP published the fix as Security Note 3771065; NVD lists the publication date as August 11, 2026.

CVE-2026-34265 (CVSS v3.1: 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-787 Out-of-bounds Write) is a memory-corruption vulnerability in SAP NetWeaver/ABAP Platform's Application Server ABAP, caused by logical errors in DIAG protocol parsing. It is exploitable by an unauthenticated network attacker and can disclose sensitive system information or crash the affected process. NVD's confirmed affected build list is: KRNL64NUC 7.22, 7.22EXT, 7.22EXT2, 7.22EXT3, and KERNEL/ABAP Platform builds 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, and 9.19; the fix is documented in SAP Security Note 3714806. NVD's publication timestamp for this record (August 10, 2026) is one day ahead of SAP's coordinated August 11 Patch Day announcement, a UTC-boundary artifact seen across SAP's monthly disclosures.

CVE-2026-44772 (CVSS 9.9) and CVE-2026-44758 (CVSS v3.1: 9.1, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, CWE-94) are code-injection flaws in SAP Manufacturing Integration and Intelligence (MII; affected as XMII 15.4/15.5 for CVE-2026-44758). Both require an attacker to already hold elevated ('high') privileges within the application; SecurityWeek's analysis further distinguishes that CVE-2026-44772 needs only 'standard' privileges while CVE-2026-44758 requires a higher privilege level, consistent with the PR:H CVSS component on -44758. In both cases, vulnerable servlets process crafted input without sufficient validation, resulting in execution of arbitrary commands on the underlying host OS. The CVSS Scope-Changed (S:C) rating on CVE-2026-44758 reflects that impact extends beyond the vulnerable MII component to the host OS. SAP's fix for CVE-2026-44758 is documented in Security Note 3758900 (NVD publication timestamp August 10, 2026); CVE-2026-44772 remains a RESERVED-only CVE ID with no published NVD record at time of research (confirmed via direct NVD and CVE.org lookups), so only the vendor/press-reported CVSS and vulnerability class are confirmed.

SAP made no mention of in-the-wild exploitation for any of the four CVEs, and as of the CISA KEV catalog's August 10, 2026 release (catalog version 2026.08.10, 1,662 entries, confirmed by direct fetch), none of the four are listed as known-exploited. No PoC code was found to be publicly available at the time of this research. SecurityWeek additionally notes the same Patch Day carried 8 high-severity notes spanning ABAP Developer Tools, Commerce Cloud, Change and Transport System, BusinessObjects, and the Business AI Platform (Approuter) component, indicating a broad patch scope beyond the four critical CVEs documented here.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1211 Exploitation for Stealth
- T1082 System Information Discovery
- T1005 Data from Local System
- T1499.004 Application or System Exploitation
- T1595.002 Active Scanning
- T1213 Data from Information Repositories
- T1565.001 Data Manipulation
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1587.004 Develop Capabilities: Exploits
- T1583.004 Acquire Infrastructure: Server
- T1068 Exploitation for Privilege Escalation
- T1210 Exploitation of Remote Services
- T1595.001 Active Scanning

## Sources

- [SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities](https://www.securityweek.com/sap-patches-critical-code-injection-memory-corruption-vulnerabilities/)
- [SAP Security Patch Day - August 2026](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2026.html)
- [SAP Security Note 3771065 (CVE-2026-58231)](https://me.sap.com/notes/3771065)
- [SAP Security Note 3714806 (CVE-2026-34265)](https://me.sap.com/notes/3714806)
- [SAP Security Note 3758900 (CVE-2026-44758)](https://me.sap.com/notes/3758900)
- [NVD Detail - CVE-2026-58231](https://nvd.nist.gov/vuln/detail/CVE-2026-58231)
- [NVD Detail - CVE-2026-34265](https://nvd.nist.gov/vuln/detail/CVE-2026-34265)
- [NVD Detail - CVE-2026-44758](https://nvd.nist.gov/vuln/detail/CVE-2026-44758)
- [NVD Detail - CVE-2026-44772 (RESERVED, no published record)](https://nvd.nist.gov/vuln/detail/CVE-2026-44772)
- [CISA Known Exploited Vulnerabilities Catalog v2026.08.10 (four CVEs absent)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [CVE-2026-58231 Technical Detail](https://cve.threatint.com/CVE/CVE-2026-58231)
- [Live Cybersecurity Brief for August 11, 2026](https://infosecnexus.com/live-cybersecurity-brief/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1984