SAP Commerce CVE-2019-0344: virtualjdbc Deserialization

What to do

1. Record the platform version of every SAP Commerce / Hybris system, including old staging and disaster-recovery copies.
2. On 6.4 through 1905, confirm Security Note 2786035 is applied; if not, apply it or move to a supported release.
3. Check whether the virtualjdbc extension is loaded (localextensions.xml or the Administration Console extension list) and remove it if you do not use it.
4. Keep Administration Console and back-office paths off the internet; allow them only from admin networks.
5. If an unpatched system was internet-facing, rebuild it and rotate the database, integration and payment credentials it holds.

How to check if you are affected or compromised

• grep -i virtualjdbc in web server and load balancer access logs for requests from outside your admin networks.
• Look for unexpected child processes, shells or outbound connections started by the account the Commerce JVM runs as.
• Check the Commerce install and temp directories for recently added JSP, JAR or script files nobody deployed.
• Review database and application admin accounts for entries created outside change control.

What happened#

On August 13, 2019, SAP's Security Patch Day shipped Security Note 2786035, rated "Hot News." It fixes two code injection bugs in SAP Commerce Cloud, the product formerly called Hybris. CVE-2019-0344 sits in the virtualjdbc extension. CVE-2019-0343, fixed by the same note, sits in the mediaconversion extension. The CVE record, published August 14, 2019, says unsafe deserialization in virtualjdbc lets an attacker "execute arbitrary code on a target machine with 'Hybris' user rights." SAP rated the note CVSS 9.0. NVD and CISA both score it 9.8, with no login or user interaction required.

Five years later, on September 30, 2024, CISA added it to the KEV catalog "based on evidence of active exploitation." Federal agencies had until October 21, 2024. CISA's enrichment marks it as automatable with total technical impact.

Who is affected#

SAP Commerce Cloud versions 6.4, 6.5, 6.6, 6.7, 1808, 1811 and 1905 without Note 2786035. Later releases are not listed. The note itself sits behind SAP's support login, so the exact patch levels are not publicly verifiable as of Oct 23, 2026. These are all old releases. A partner write-up notes that even the last on-premises release, 2205, left mainstream maintenance on July 31, 2026.

Do you really need to act?#

Most SAP Commerce shops moved past 1905 years ago, so this is a check, not a scramble. Neither CISA nor anyone else has published who exploited it or how. SecurityWeek noted there had been "no previous reports of in-the-wild exploitation." We found no later public write-up tying it to a campaign as of Oct 23, 2026.

The risk sits in long-lived storefronts that were frozen on an old release, and in forgotten staging or disaster-recovery copies. These systems hold customer data, order history and payment integration credentials. Code running as the Commerce service account can reach all of it. If such a system was reachable and never got the note, treat a later upgrade as a fix, not as proof it was never touched.

What to do now#

1. List every Commerce system and its platform version, including non-production copies.
2. On 6.4 through 1905, confirm Note 2786035 is in place. If it is not, apply it, or better, move to a supported release.
3. Check whether the extension is loaded: grep -n virtualjdbc hybris/config/localextensions.xml, or review the extension list in the Administration Console. Remove it if nothing uses it.
4. Limit the Administration Console and back-office paths to admin networks.
5. If an unpatched system faced the internet, rebuild it and rotate its database, integration and payment credentials.

How to tell if you were hit#

Search proxy and load balancer logs with grep -i virtualjdbc for requests from outside your admin networks. On the host, look for shells, scripts or outbound connections started by the account the Commerce JVM runs as. Check the install and temp directories for JSP, JAR or script files nobody deployed. Review admin accounts in the application and database for entries created outside change control. Because CISA published no indicators, absence of evidence here is weak. Base the decision on whether the system was exposed and unpatched.

Timeline#

• Aug 13, 2019 — SAP releases Security Note 2786035 on Patch Day.
• Aug 14, 2019 — CVE-2019-0344 is published.
• Sep 30, 2024 — CISA adds the CVE to KEV.
• Oct 21, 2024 — Federal remediation deadline.
• Jul 31, 2026 — Mainstream maintenance ends for the last on-premises release, 2205.

Vulnerability records

• CVE-2019-0344 · KEV 2024-09-30 · Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. SAP — SAP Security Patch Day, August 2019 (archived) web.archive.org
2. CVE record — CVE-2019-0344 cve.org
3. NVD — CVE-2019-0344 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2019-0344 cisa.gov
5. CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Sep 30, 2024) cisa.gov
6. Arineo — End of Support for SAP Commerce On-Premises: What B2B companies need to know arineo.com

Coverage and analysis

1. SecurityWeek — Organizations Warned of Exploited SAP, Gpac and D-Link Vulnerabilities securityweek.com