Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is poss…

published 2019-08-14 7y ago modified 2026-06-17 4mo ago also EUVD-2019-1117

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2024-09-30
epss: 7.5%; EPSS 7.5% chance of exploitation in 30 days, percentile 94%
public exploits: 0; none known

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Is CVE-2019-0344 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2019-08-14 Published
2024-09-30 Added to CISA KEV
2024-10-04 CISA SSVC: exploitation active
2024-10-21 CISA patch deadline

Known exploited

Added: 2y ago (2024-09-30)
Patch by: 2024-10-21 (2y ago)
Ransomware: Not known
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product: SAP, Commerce Cloud
CISA name: SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 2y ago (2024-10-04)

Exploit prediction

7.47% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

SAP SE SAP Commerce Cloud (virtualjdbc extension)
sap commerce_cloud

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

launchpad.support.sap.com /#/notes/2786035
permissions-required, vendor-advisory
wiki.scn.sap.com /wiki/pages/viewpage.action?pageId=523998017
broken-link
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344
government-resource, us-government-resource

Sources

CVE List CVE-2019-0344
NVD CVE-2019-0344

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json critical feed