Vulnerability intelligence
CVE-2019-0344
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
SAP Commerce Cloud
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
CVSS Score
9.8
Critical
EPSS — Exploit Probability
7.1%
Riskier than 94% of all CVEs · checked 2026-09-29
Exploitation
Confirmed in the wild
KEV since 2024-09-30
Remediation
Patch available
Federal deadline 2024-10-21
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2024-10-21.
1 article across 1 outlet · first covered Aug 17, 2026 · latest Aug 17, 2026
Coverage timeline
-
SAP Commerce Cloud flaw lets attackers run code after patch delaywww.securityweek.com · Aug 17, 2026