CVE-2019-0344: SAP Commerce Cloud virtualjdbc unsafe deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and confirmed active exploitation in CISA KEV make this an urgent patch.

What it is

SAP Commerce Cloud's virtualjdbc extension deserializes untrusted data without validation across versions 6.4 through 1905. An unauthenticated remote attacker can exploit this to execute arbitrary code with Hybris user rights. The flaw is critical because it is network-reachable, needs no credentials or user interaction, and is listed in CISA KEV.

Impact

An attacker gains arbitrary code execution on the target host under the Hybris service account, enabling full compromise of the SAP Commerce Cloud instance and its data.

Attack surface

Reachable over the network via the virtualjdbc extension with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any exposed virtualjdbc endpoint is a candidate entry point.

Exploitation

CVE-2019-0344 is listed in CISA KEV (added 2024-09-30, due 2024-10-21), confirming active exploitation; EPSS 30-day probability is 0.07079 (93.9th percentile). No ransomware campaign use is documented.

What to do

• Apply the SAP security note 2786035 patch for the affected Commerce Cloud versions (6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905) immediately.
• If patching is not possible, restrict network access to the virtualjdbc extension and block untrusted deserialization endpoints at the perimeter.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.
• Verify the Hybris service account runs with least privilege to limit post-exploitation impact.
• Monitor SAP security notes for updated guidance since the referenced wiki link is broken.

Detection

• Monitor network traffic to virtualjdbc endpoints for serialized Java object payloads or unexpected deserialization requests.
• Alert on child processes spawned by the Hybris/Java service account, especially shells or scripting interpreters.
• Review application and web server logs for anomalous requests to the virtualjdbc extension path.
• Hunt for outbound connections from the SAP Commerce Cloud host to unknown external IPs that may indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.