Critical 9.8Known exploited (CISA KEV)Published Aug 14, 2019

CVE-2019-0344Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hyb…

Updated under an hour ago (2026-10-19 07:50 UTC)

Does this affect you?

It affects SAP SE SAP Commerce Cloud (virtualjdbc extension) and 1 other product. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Sep 30, 2024; federal agencies had to remediate by Oct 21, 2024. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for SAP SE SAP Commerce Cloud (virtualjdbc extension)

Exploited in the last 30 days

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-502
Known exploited: Added to CISA KEV Sep 30, 2024; federal remediation due Oct 21, 2024Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 7.08% (percentile 94)
Assigned by: sap
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

SAP SE SAP Commerce Cloud (virtualjdbc extension) sap_se:sap_commerce_cloud_virtualjdbc_extension (from the name)	before 6.4; before 6.5; before 6.6; before 6.7; before 1808; before 1811; before 1905	CNA record
sap commerce_cloud sap:commerce_cloud	1808; 1811; 1905; 6.4; 6.5; 6.6; 6.7	CISA ADP
sap commerce_cloud sap:commerce_cloud	6.4; 6.5; 6.6; 6.7; 1808; 1811; 1905	NVD

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017x-refsource-misc, broken-link
https://launchpad.support.sap.com/#/notes/2786035x-refsource-misc, permissions-required, vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.