CVE-2026-58233— Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)
Quick assessment
Affected
SAP_SE SAP Change and Transport System Attach Tool (ctsattach)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP_SE SAP Change and Transport System Attach Tool是SAP_SE的一个专用命令行实用程序。 SAP Change and Transport System Attach Tool存在反序列化注入漏洞，该漏洞源于对特制存档文件处理时存在不安全反序列化，可能导致经过身份验证的攻击者远程执行代码并提取敏感信息。
Possible ATT&CK Techniques 3 AI
T1055 · Process Injection T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP Change and Transport System Attach Tool (ctsattach) | CTS_UPLOAD_CLT 1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-58233
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)
Source: CVE Program / CVE List V5
Vulnerability Description
SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure deserialization and lead to remote code execution (RCE) on the system. Successful exploitation requires a victim to process the malicious archive, enabling the attacker to execute the RCE and extract sensitive information and gain control over the system and its processes. This vulnerability has a high impact on confidentiality and integrity of the data, with a low impact on the availability of the system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Change and Transport System Attach Tool 反序列化注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP_SE SAP Change and Transport System Attach Tool是SAP_SE的一个专用命令行实用程序。 SAP Change and Transport System Attach Tool存在反序列化注入漏洞，该漏洞源于对特制存档文件处理时存在不安全反序列化，可能导致经过身份验证的攻击者远程执行代码并提取敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Change and Transport System Attach Tool (ctsattach) | CTS_UPLOAD_CLT 1 | - |
|
II. Public POCs for CVE-2026-58233
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58233
请登录查看更多情报信息。
Vendor Pages for CVE-2026-58233 (1)
Same Patch Batch · SAP_SE · 2026-07-14 · 15 CVEs total
| CVE-2026-44747 | 9.9 CRITICAL | Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP |
| CVE-2026-27690 | 9.1 CRITICAL | HTTP Request Smuggling in SAP Approuter |
| CVE-2026-44761 | 9.1 CRITICAL | Insecure Sample Credentials in SAP Commerce Cloud |
| CVE-2026-0487 | 8.4 HIGH | DLL Hijacking vulnerability in SAProuter on Microsoft Windows |
| CVE-2026-44752 | 8.2 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configur |
| CVE-2026-44745 | 8.1 HIGH | Open Redirect vulnerability in SAP Approuter |
| CVE-2026-44767 | 6.1 MEDIUM | Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection |
| CVE-2026-44759 | 6.1 MEDIUM | Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-44769 | 5.5 MEDIUM | SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO) |
| CVE-2026-44760 | 4.7 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applica |
| CVE-2026-44771 | 4.3 MEDIUM | Missing Authorization check in SAP S/4HANA (Draft operation) |
| CVE-2026-44770 | 4.3 MEDIUM | Missing Authorization check in SAP S/4 HANA (Create Single Payment) |
| CVE-2026-44768 | 4.1 MEDIUM | Security misconfiguration in SAP CRM (WebClient UI) |
| CVE-2026-44753 | 3.7 LOW | Information Disclosure vulnerability in SAP HANA Extended Application Services classic mod |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-502
-
CVE-2026-67615
openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserializ -
CVE-2026-28325
SolarWinds Observability Self-Hosted Unauthenticated Remote -
CVE-2026-43642
Softaculous Virtualizor PHP Object Injection via Billing Mod -
CVE-2026-83803
Sentry: Unsafe pickle deserialization in Relocation Feature -
CVE-2026-95806
MISP: PHP phar stream wrapper enables deserialization and co
V. Comments for CVE-2026-58233
No comments yet