SAP Commerce Cloud's 3-day patch gap.

Transcript

SAP shipped a fix for a maximum severity flaw in Commerce Cloud. Three days later, attackers were already probing it. Here is what makes that unusual. There was no public exploit. Nobody had published proof of concept code. A security team checking the usual signals would have seen a bug marked not known to be exploited, and pushed it down the queue. But the attackers never needed a published exploit, because the patch itself is a blueprint. Pull the fixed release, compare it against the old one, and the changed functions tell you exactly what was broken. Three days is roughly how long that takes. So if you are waiting for a proof of concept before treating a critical flaw as urgent, you are already late.