Vulnerabilities

CVSS

9.8 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEV

Published

2019-08-14

Status

Published

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

Weaknesses

Code InjectionCWE-502

Coverage 1

vulnerability

Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure

A critical vulnerability in SAP Commerce Cloud was rapidly exploited by hackers just days after its public announcement. The flaw, tracked as CVE-2026-58231, allows for arbitrary code execution and poses a significant ri…

SecurityWeek · Aug 17, 2026 Critical

CVE-2026-58231CVE-2019-0344sapcommercevulnerability

All articles mentioning it

Advisories and references

• wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
• launchpad.support.sap.com/#/notes/2786035
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-...