SAP Commerce CVE-2019-0344: virtualjdbc Deserialization
Patched by SAP in August 2019 and only listed as exploited in 2024; the work is to confirm no Commerce system still runs 6.4 through 1905 without Note 2786035, and to hunt on any that did while reachable.
Must act: Owners of SAP Commerce (Hybris) 6.4, 6.5, 6.6, 6.7, 1808, 1811 or 1905 systems where Security Note 2786035 was never applied, especially with the virtualjdbc extension loaded and reachable.
Can relax: Teams on releases newer than 1905, or on those versions with Note 2786035 applied, and anyone whose Commerce build does not load the virtualjdbc extension.
- Record the platform version of every SAP Commerce / Hybris system, including old staging and disaster-recovery copies.
- On 6.4 through 1905, confirm Security Note 2786035 is applied; if not, apply it or move to a supported release.
- Check whether the virtualjdbc extension is loaded (localextensions.xml or the Administration Console extension list) and remove it if you do not use it.