Threat actors have been probing and exploiting a maximum-severity flaw in SAP Commerce Cloud for three days after official fixes were released This article explores sap deployments vulnerable. . Defused honeypot telemetry detected the first wave of unauthenticated remote-execution traffic circulating on the internet, despite the absence of a public proof of concept.
SAP Commerce Cloud is crucial for large-scale digital storefronts and supply chain operations, making it a prime target for attackers looking to gain full administrative control over backend databases, transaction pipelines, and sensitive enterprise assets. Activity logs show inbound attack traffic originating from hosting infrastructure located in Charlotte Colocation Center (AS11402) in the United States, specifically from IP address 216.249.99[. ]43.
View the full payload: https://t.co/gxfaqggv8a pic.twitter.com/zmjuo45ahx Threat intelligence engines identified initial bursts as automated mass scanning, suggesting opportunistic actors systematically scan internet-facing SAP deployments to find vulnerable installations. Organizations that cannot implement the update immediately should consider isolating exposed management interfaces behind a virtual private network (VPN) and enforcing strict access control lists to minimize attack exposure. -> Integrate ANY.RUN with your SOC now.
