SAP ctsattach EUVD-2026-43596

Exploitation requires the attacker to hold valid low-privilege credentials on the SAP system (PR:L - not anonymous), and critically requires a victim to actually process the attacker's crafted archive file through the ctsattach tool (UI:R), meaning it does not fire automatically. The concrete prerequisite is that the malicious, specially crafted archive must be ingested by ctsattach's deserialization routine; without that file being processed there is no code execution. Limiting factors that reduce realistic risk: the required valid authentication, the mandatory victim interaction to open/process the archive, and dependence on the specific affected ctsattach tool being present and used in the SAP transport workflow - this is not exploitable against a default configuration with no user action.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L, base 7.6 High) indicates a network-reachable but not fully unauthenticated attack: PR:L means the attacker needs valid low-level credentials, and UI:R means a victim must actively process the malicious archive, so this is not a wormable, zero-click flaw. The description reinforces this - 'successful exploitation requires a victim to process the malicious archive' - which aligns with UI:R and materially lowers real-world likelihood versus a drive-by RCE. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified; the absence of these signals means this should be treated as a credible-but-not-emergency patch item rather than an actively exploited threat. One point to verify with the vendor: AV:N combined with a required file-processing step is common for tools that ingest remotely delivered files, but if ctsattach only processes locally staged archives the practical vector may be closer to local/adjacent - confirm the delivery path against the SAP note.

An attacker with low-privileged but valid access to the SAP landscape crafts a malicious transport/archive file containing a hostile serialized object graph and stages it where an administrator will pick it up. When a victim runs ctsattach to process that archive, the tool's library deserializes the attacker's data and executes arbitrary code on the host, giving the attacker read access to sensitive data and control over system processes. No public exploit is identified at time of analysis, and the AV:N/AC:L profile means the attack is technically simple once the crafted file is processed.