CRITICAL Actively exploited CWE-502
CVE-2019-0344
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
SAP·Commerce Cloud
9.8/ 10
CVSS 3.1
Critical severity
7.5%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 95% of all CVEs
Listed
CISA KEV catalog
- Added
- Sep 30, 2024
- Fix due
- Oct 21, 2024
- Ransomware
- Not known
Timeline
- Published
- Aug 14, 2019
- Updated
- Oct 21, 2025
- First covered
- Aug 17, 2026
- Latest story
- 3 months ago
Summary
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
CWE-502Deserialization of Untrusted Data
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected products
- SAP Commerce Cloud (virtualjdbc extension)< 6.4< 6.5< 6.6< 6.7