---
title: "SAP Commerce CVE-2019-0344: virtualjdbc Deserialization"
url: https://erroneo.us/security/briefs/sap-commerce-cloud-cve-2019-0344-virtualjdbc-deserialization/
description: "A 2019 deserialization flaw in SAP Commerce (Hybris) 6.4-1905 joined CISA KEV in Sep 2024. Confirm Note 2786035 or a later release; hunt old hosts."
type: security-brief
section: "Security Digest"
date_published: 2019-08-13
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2019-0344"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SAP Commerce CVE-2019-0344: virtualjdbc Deserialization

**Verdict: Check exposure.** Patched by SAP in August 2019 and only listed as exploited in 2024; the work is to confirm no Commerce system still runs 6.4 through 1905 without Note 2786035, and to hunt on any that did while reachable.

- **Who must act:** Owners of SAP Commerce (Hybris) 6.4, 6.5, 6.6, 6.7, 1808, 1811 or 1905 systems where Security Note 2786035 was never applied, especially with the virtualjdbc extension loaded and reachable.
- **Who can relax:** Teams on releases newer than 1905, or on those versions with Note 2786035 applied, and anyone whose Commerce build does not load the virtualjdbc extension.
- **Affected:** SAP Commerce Cloud (virtualjdbc extension) 6.4, 6.5, 6.6, 6.7, 1808, 1811 and 1905 without SAP Security Note 2786035
- **Fixed:** SAP Security Note 2786035 (August 13, 2019 Patch Day; login required); Releases later than 1905 are not listed as affected
- **CVEs:** CVE-2019-0344
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Record the platform version of every SAP Commerce / Hybris system, including old staging and disaster-recovery copies.
2. On 6.4 through 1905, confirm Security Note 2786035 is applied; if not, apply it or move to a supported release.
3. Check whether the virtualjdbc extension is loaded (localextensions.xml or the Administration Console extension list) and remove it if you do not use it.
4. Keep Administration Console and back-office paths off the internet; allow them only from admin networks.
5. If an unpatched system was internet-facing, rebuild it and rotate the database, integration and payment credentials it holds.

### How to check if you are affected

- grep -i virtualjdbc in web server and load balancer access logs for requests from outside your admin networks.
- Look for unexpected child processes, shells or outbound connections started by the account the Commerce JVM runs as.
- Check the Commerce install and temp directories for recently added JSP, JAR or script files nobody deployed.
- Review database and application admin accounts for entries created outside change control.

## What happened

On August 13, 2019, SAP's [Security Patch Day](https://web.archive.org/web/20191214053020/https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017) shipped Security Note 2786035, rated "Hot News." It fixes two code injection bugs in SAP Commerce Cloud, the product formerly called Hybris. CVE-2019-0344 sits in the `virtualjdbc` extension. CVE-2019-0343, fixed by the same note, sits in the `mediaconversion` extension. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2019-0344), published August 14, 2019, says unsafe deserialization in virtualjdbc lets an attacker "execute arbitrary code on a target machine with 'Hybris' user rights." SAP rated the note CVSS 9.0. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-0344) and CISA both score it 9.8, with no login or user interaction required.

Five years later, on September 30, 2024, CISA [added it](https://www.cisa.gov/news-events/alerts/2024/09/30/cisa-adds-four-known-exploited-vulnerabilities-catalog) to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344) "based on evidence of active exploitation." Federal agencies had until October 21, 2024. CISA's enrichment marks it as automatable with total technical impact.

## Who is affected

SAP Commerce Cloud versions 6.4, 6.5, 6.6, 6.7, 1808, 1811 and 1905 without Note 2786035. Later releases are not listed. The note itself sits behind SAP's support login, so the exact patch levels are not publicly verifiable as of Oct 23, 2026. These are all old releases. A [partner write-up](https://arineo.com/en/blog-en/end-of-support-for-sap-commerce-on-premises-what-b2b-companies-need-to-know/) notes that even the last on-premises release, 2205, left mainstream maintenance on July 31, 2026.

## Do you really need to act?

Most SAP Commerce shops moved past 1905 years ago, so this is a check, not a scramble. Neither CISA nor anyone else has published who exploited it or how. [SecurityWeek](https://www.securityweek.com/organizations-warned-of-exploited-sap-gpac-and-d-link-vulnerabilities/) noted there had been "no previous reports of in-the-wild exploitation." We found no later public write-up tying it to a campaign as of Oct 23, 2026.

The risk sits in long-lived storefronts that were frozen on an old release, and in forgotten staging or disaster-recovery copies. These systems hold customer data, order history and payment integration credentials. Code running as the Commerce service account can reach all of it. If such a system was reachable and never got the note, treat a later upgrade as a fix, not as proof it was never touched.

## What to do now

1. List every Commerce system and its platform version, including non-production copies.
2. On 6.4 through 1905, confirm Note 2786035 is in place. If it is not, apply it, or better, move to a supported release.
3. Check whether the extension is loaded: `grep -n virtualjdbc hybris/config/localextensions.xml`, or review the extension list in the Administration Console. Remove it if nothing uses it.
4. Limit the Administration Console and back-office paths to admin networks.
5. If an unpatched system faced the internet, rebuild it and rotate its database, integration and payment credentials.

## How to tell if you were hit

Search proxy and load balancer logs with `grep -i virtualjdbc` for requests from outside your admin networks. On the host, look for shells, scripts or outbound connections started by the account the Commerce JVM runs as. Check the install and temp directories for JSP, JAR or script files nobody deployed. Review admin accounts in the application and database for entries created outside change control. Because CISA published no indicators, absence of evidence here is weak. Base the decision on whether the system was exposed and unpatched.

## Timeline

- Aug 13, 2019 — SAP releases Security Note 2786035 on Patch Day.
- Aug 14, 2019 — CVE-2019-0344 is published.
- Sep 30, 2024 — CISA adds the CVE to KEV.
- Oct 21, 2024 — Federal remediation deadline.
- Jul 31, 2026 — Mainstream maintenance ends for the last on-premises release, 2205.

## Sources

1. [SAP — SAP Security Patch Day, August 2019 (archived)](https://web.archive.org/web/20191214053020/https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017)
2. [CVE record — CVE-2019-0344](https://www.cve.org/CVERecord?id=CVE-2019-0344)
3. [NVD — CVE-2019-0344](https://nvd.nist.gov/vuln/detail/CVE-2019-0344)
4. [CISA — Known Exploited Vulnerabilities: CVE-2019-0344](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344)
5. [CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Sep 30, 2024)](https://www.cisa.gov/news-events/alerts/2024/09/30/cisa-adds-four-known-exploited-vulnerabilities-catalog)
6. [Arineo — End of Support for SAP Commerce On-Premises: What B2B companies need to know](https://arineo.com/en/blog-en/end-of-support-for-sap-commerce-on-premises-what-b2b-companies-need-to-know/)
7. [SecurityWeek — Organizations Warned of Exploited SAP, Gpac and D-Link Vulnerabilities](https://www.securityweek.com/organizations-warned-of-exploited-sap-gpac-and-d-link-vulnerabilities/)

---
Source page: https://erroneo.us/security/briefs/sap-commerce-cloud-cve-2019-0344-virtualjdbc-deserialization/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt