Two Zero-Day Flaws Under Active Attack: GeoServer Unpatched, SAP Commerce Cloud Patched but Exploited

Two critical security vulnerabilities in widely used enterprise platforms are being actively exploited in the wild. While the GeoServer flaw remains unpatched, attackers have already targeted SAP Commerce Cloud just days after a fix was released.

The first vulnerability affects GeoServer, an open-source server for sharing geospatial data. The flaw, which has not yet been assigned a CVE identifier, is an SQL injection vulnerability that can lead to remote code execution (RCE). It was first disclosed on August 12, 2026, by researcher @q1uf3ng on X. According to the researcher, the issue allows unauthorized SQL injection, and with system administrator database privileges, achieving RCE is possible.

The threat intelligence platform watchTowr reported that it began observing exploitation attempts within hours of the public disclosure. Hundreds of probes have been detected, originating from a small pool of IP addresses. Jake Knott, principal security researcher at watchTowr, stated that attackers are currently probing to identify vulnerable systems, triggering errors without proceeding further. However, he warned that this situation is unlikely to last, given GeoServer's track record of being targeted and exploited at scale. Multiple GeoServer vulnerabilities are listed in CISA's Known Exploited Vulnerabilities catalog. Under certain configurations, this latest flaw could ultimately lead to RCE.

In the absence of a patch, organizations running GeoServer are advised to identify exposed instances, restrict public access, and monitor for a vendor fix.

The second vulnerability, tracked as CVE-2026-58231, impacts SAP Commerce Cloud and carries the maximum CVSS score of 10.0. The issue stems from insufficient authorization checks and input validation. According to CVE.org, an unauthenticated attacker can abuse a default authentication client to submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability.

According to Defused Cyber, exploitation attempts against CVE-2026-58231 began hitting its honeypot systems just three days after the patch was released. The company noted that the vulnerability has no public proof-of-concept and was not previously known to be exploited. SAP security firm Onapsis confirmed that successful exploitation could permit arbitrary code execution and compromise internal components. Onapsis urged customers to patch to the fixed Commerce Cloud release levels referenced in the security note and rebuild or redeploy the updated version. As a temporary workaround, organizations can reduce their exposure by configuring an IP Filter Set in SAP Commerce Cloud to restrict access to the vulnerable endpoint.

There are currently no details on who is behind the exploitation attempts targeting either flaw.