Is CVE-2026-58233 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58233 being exploited in the wild.

How severe is CVE-2026-58233?

High severity, with a CVSS score of 7.6, published 14 July 2026.

Which products and versions are affected?

SAP SE Change and Transport System Attach Tool CTS_UPLOAD_CLT 1.

Is there a fix for CVE-2026-58233?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-58233 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-58233?

Check whether you run SAP SE Change and Transport System Attach Tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58233: SAP Change and Transport System Attach Tool insecure deserialization

CVE-2026-58233 · Severity: high · CVSS 7.6 · Published 2026-07-14

SAP Change and Transport System Attach Tool (ctsattach) is used to manage and move software changes across different SAP systems. A vulnerability in this tool allows an attacker to provide a malicious archive file that, if processed by a user, allows the attacker to take control of the system. This could lead to the theft of sensitive business data and disruption of system integrity, though it is less likely to cause a total service outage.

Vendors: SAP SE.

Quick answers

Is CVE-2026-58233 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58233 being exploited in the wild.
How severe is CVE-2026-58233?: High severity, with a CVSS score of 7.6, published 14 July 2026.
Which products and versions are affected?: SAP SE Change and Transport System Attach Tool CTS_UPLOAD_CLT 1.
Is there a fix for CVE-2026-58233?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58233 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58233?: Check whether you run SAP SE Change and Transport System Attach Tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An insecure deserialization vulnerability (CWE-502) exists in the SAP Change and Transport System Attach Tool (ctsattach) library. An authenticated attacker with network access can supply a specially crafted archive file to the application. If a victim processes this malicious archive, the application's library fails to safely deserialize the data, allowing the attacker to execute arbitrary code on the underlying system. This can result in full compromise of confidentiality and integrity, though it requires user interaction to trigger the processing of the archive. SAP has released Security Note 3773304 to address this issue.

Affected products

SAP SE Change and Transport System Attach Tool (ctsattach) CTS_UPLOAD_CLT 1

Timeline

2026-07-14: advisory: Published as part of SAP July 2026 Security Patch Day
2026-07-13: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.