Three days. That’s how long it took attackers to weaponize a maximum severity flaw in SAP’s cloud commerce platform after the company patched it, and researchers say that window keeps shrinking for a reason that has little to do with SAP itself.
SAP fixed the bug, tracked as CVE-2026-58231, on August 11 in SAP Commerce Cloud, the platform large enterprises rely on to run B2B and B2C sales operations from the cloud. Researchers at Defused spotted active exploitation in the wild just three days later, according to a post on X. The flaw carried a perfect 10.0 severity score, stemming from missing authorization checks and weak input validation, the kind of gap that lets an attacker walk straight past login screens into a live cloud environment.
Because it’s cloud infrastructure, the exposure runs wider than a single server. Companies including Samsung, Mercedes-Benz, Shell, BP, and Alphabet all run their commerce operations on this platform, so a flaw here threatens the transaction backbone of some of the largest businesses on the planet, all sitting on shared cloud architecture.
What’s driving the speed, according to Gunter Ollmann, chief technology officer at Cobalt, is AI. Reverse engineering a cloud patch used to take a skilled researcher real time and effort, comparing old code against new code by hand to find what changed. Now, AI-assisted analysis tools do that comparison automatically, pinpoint the exact logic that shifted, and help generate working exploit code in a fraction of the time it once took.
“We are watching patch-to-exploit windows shrink from days toward minutes for certain vulnerability classes, and that trend will only accelerate,” Ollmann said.
Chris Radkowski, a GRC expert at Pathlock, argued the real lesson isn’t simply to patch faster. Because cloud-hosted SAP systems sit at the center of so much business-critical data, he said companies need real-time visibility into what’s happening inside their cloud environments, so a delayed patch or a missed alert doesn’t spiral into something much bigger.
Ollmann noted that honeypot telemetry picked up exploitation attempts before any public proof-of-concept code even existed, which tells him sophisticated attackers are working on their own accelerated clock rather than waiting on public research.
His advice for organizations running cloud commerce platforms is blunt: treat every patch as time-sensitive, not scheduled maintenance, and assume automated exploitation attempts against internet-facing cloud instances are already underway. The window for reacting, he said, now runs in hours, not days.
