Loading vulnerability…
Insecure Deserialization RCE in SAP CTS+ Attach Tool
CVE-2026-58233 is an insecure deserialization vulnerability in the SAP Change and Transport System Attach Tool (ctsattach), associated with CTS_UPLOAD_CLT 1. An authenticated attacker can supply a specially crafted archive that triggers insecure deserialization when processed by the application's library. Exploitation requires a victim to process the malicious archive and can result in remote code execution, sensitive information disclosure, and control over the affected system and its processes. SAP states that no version of the tool is unaffected and has ended support for it.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits code execution on the affected system, extraction of sensitive information, and control over system processes. Confidentiality and integrity can be substantially compromised; the stated impact on system availability is limited.
If you can’t patch tonight, do this now.
Cease use of the tool and do not process archives with it while completing removal. No separate supported workaround is identified.
Patch, then assume compromise.
Stop using the SAP CTS+ Attach Tool and remove all copies from affected systems. Follow SAP Security Note 3773304 and the removal guidance in SAP Note 2473648. SAP has ended support for the tool and states that there is no unaffected version; upgrading to a fixed tool version is therefore not an identified remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.