What’s Vulnerable › Vulnerabilities

CVE-2026-58233: Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)

• Severity: high (CVSS 7.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-502

Description

SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure deserialization and lead to remote code execution (RCE) on the system. Successful exploitation requires a victim to process the malicious archive, enabling the attacker to execute the RCE and extract sensitive information and gain control over the system and its processes. This vulnerability has a high impact on confidentiality and integrity of the data, with a low impact on the availability of the system.

Affected products

• SAP_SE SAP Change and Transport System Attach Tool (ctsattach): CTS_UPLOAD_CLT 1

References

• https://me.sap.com/notes/3773304
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-58233 or the next vulnerability affects your stack