EUVD-2026-43596
GHSA-hfjv-fqqx-2hxw
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Requires valid low-privilege credentials (PR:L) and a victim to process the crafted archive (UI:R); deserialization gives high C/I with limited availability impact (A:L).
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure deserialization and lead to remote code execution (RCE) on the system. Successful exploitation requires a victim to process the malicious archive, enabling the attacker to execute the RCE and extract sensitive information and gain control over the system and its processes. This vulnerability has a high impact on confidentiality and integrity of the data, with a low impact on the availability of the system.
AnalysisAI
Insecure deserialization in the SAP Change and Transport System Attach Tool (ctsattach) lets an authenticated, low-privileged attacker achieve remote code execution by supplying a crafted archive that a victim then processes through the tool's library. Successful exploitation yields high confidentiality and integrity impact - attackers can read sensitive data and take control of the host and its processes - with low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause and 7.6 CVSS make this a meaningful patch priority for SAP landscapes.
Technical ContextAI
The affected component is SAP's Change and Transport System (CTS) attach tool, ctsattach, which is part of the SAP Basis/administration tooling used to move transports and archive artifacts between SAP systems. The root cause is CWE-502 (Deserialization of Untrusted Data): the tool's underlying library reconstructs objects from an attacker-controlled archive file without adequately validating or restricting the serialized data, allowing crafted object graphs to trigger code execution during deserialization. Per the CPE data (cpe:2.3:a:sap_se:sap_change_and_transport_system_attach_tool_(ctsattach)), only the ctsattach tool from SAP SE is enumerated as affected; exact version boundaries are not provided in the NVD CPE and must be confirmed via the SAP note.
RemediationAI
Apply the fix referenced in SAP Security Note 3773304 (https://me.sap.com/notes/3773304), released via SAP Security Patch Day (https://url.sap/sapsecuritypatchday); the note requires SAP authentication to view exact patched versions, so retrieve and apply the corresponding SAP Basis/support-package or patch level for your release rather than an invented version number. Patch available per vendor advisory. As compensating controls until patching, restrict who can invoke ctsattach and who can supply transport/archive files to trusted administrators only (reducing the pool of authenticated actors that satisfy PR:L), and avoid processing archive files received from untrusted or external sources since exploitation requires a victim to process the malicious archive (mitigating UI:R); note the trade-off that tightening transport-file handling can slow legitimate change-management workflows. Additionally, monitor and log ctsattach invocations and unexpected archive processing so that anomalous deserialization activity can be detected.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today