Actively exploited in the wild
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
SAP - Commerce Cloud · Listed in the CISA KEV since 2024-09-30. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2019-0344
CriticalCVSS 9.8KEVSummary
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
Risk Assessment
An attacker can remotely execute arbitrary code with 'Hybris' user privileges, potentially leading to application compromise and data access. This could result in breaches of confidentiality, integrity, and availability.
Recommendation
Immediately update SAP Commerce Cloud to a version containing the fix. If updating is not possible, restrict access to the virtualjdbc extension and monitor for suspicious activity.
Other vulnerabilities in SAP Commerce Cloud
See all- CVE-2026-58231Critical
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability.
- CVE-2026-44761Critical
SAP Commerce Cloud may retain a sample OAuth2 client with publicly documented sample credentials from sample configuration in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.
- CVE-2026-34263Critical
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution.
- CVE-2023-39439High
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
Original NVD description (English source)
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.