CVE-2026-58233: SAP Change and Transport System RCE Flaw

CVE-2026-58233 Overview

CVE-2026-58233 is an insecure deserialization vulnerability [CWE-502] in the SAP Change and Transport System Attach Tool (ctsattach). An authenticated attacker can supply a specially crafted archive file that, when processed by the application's library, triggers unsafe deserialization and results in remote code execution (RCE). Successful exploitation requires a victim to process the malicious archive. The attacker can then execute code, extract sensitive information, and gain control over the affected system and its processes. The vulnerability has a high impact on confidentiality and integrity, with a low impact on availability.

Critical Impact
Authenticated attackers can achieve remote code execution on SAP systems by delivering a malicious archive that a legitimate user processes with ctsattach, exposing sensitive data and enabling full process control.

Affected Products

SAP Change and Transport System Attach Tool (ctsattach)
SAP components that consume archive files through the ctsattach library
Specific fixed versions are listed in SAP Note #3773304

Discovery Timeline

2026-07-14 - CVE-2026-58233 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-58233

Vulnerability Analysis

The flaw resides in how ctsattach deserializes attacker-controlled data contained in an archive file. When the tool parses a crafted archive, it reconstructs objects from the serialized stream without validating type, structure, or origin. This behavior lets an attacker embed serialized payloads that instantiate arbitrary classes or invoke unintended methods during reconstruction.

Exploitation requires a low-privileged authenticated user account and a victim interaction: a legitimate user must process the malicious archive. Once processing begins, the deserialization routine executes attacker-supplied logic in the context of the SAP process. This yields code execution on the host, disclosure of sensitive transport and configuration data, and manipulation of transport artifacts.

Root Cause

The root cause is the use of an unsafe deserialization primitive on untrusted input, mapped to [CWE-502] (Deserialization of Untrusted Data). The library trusts the archive's serialized structures and does not enforce allow-listing of permitted classes, integrity verification, or sandboxed reconstruction. Any attacker who can place a file in a location a victim opens with ctsattach can supply object graphs that trigger dangerous side effects during instantiation.

Attack Vector

The attack vector is network-based but requires low-privileged authentication and user interaction. An attacker uploads or delivers a crafted archive to a location processed by ctsattach, such as a transport directory shared across SAP systems. When an operator imports or attaches the archive, the deserialization gadget executes, and the attacker gains code execution on the underlying system. Because SAP transport processes frequently run under privileged service accounts, the resulting foothold can extend to broader SAP landscape components. Refer to SAP Note #3773304 for the vendor's technical description.

Detection Methods for CVE-2026-58233

Indicators of Compromise

Unexpected archive files (.SAR, .CAR, or transport archives) appearing in SAP transport directories from non-standard users or systems
Child processes spawned by ctsattach or the SAP transport control program (tp) that do not match normal transport workflows, such as shells, curl, wget, or scripting interpreters
Outbound network connections initiated by SAP service accounts to unknown external hosts shortly after archive processing
New or modified files in SAP kernel or profile directories following an attach operation

Detection Strategies

Monitor process creation events where the parent process is ctsattach or tp and correlate any non-standard child processes with archive processing timestamps
Enable and centralize SAP Security Audit Log (SM19/SM20) events for transport and attach operations, focusing on unusual user or system combinations
Baseline the file hashes of archives placed in transport directories and alert on files that deviate from expected sizes, sources, or origin systems

Monitoring Recommendations

Ingest SAP application server logs and OS-level process telemetry into a centralized analytics platform for cross-source correlation
Alert on authenticated users initiating archive attach operations outside of standard change windows or from unusual client hosts
Track privileged SAP service account activity for command execution patterns inconsistent with routine transport imports

How to Mitigate CVE-2026-58233

Immediate Actions Required

Apply the security fix documented in SAP Note #3773304 as soon as testing permits
Restrict write access to transport directories and archive drop locations to a minimal set of trusted administrative accounts
Audit recent archive imports and ctsattach operations for anomalous sources or unexpected user activity
Review and reduce privileges of accounts that can invoke ctsattach, enforcing least privilege for change and transport operations

Patch Information

SAP published the corrective patch in SAP Note #3773304, released as part of SAP Security Patch Day. Customers should download the note from the SAP Support Portal and apply the referenced Support Package or kernel patch to affected systems. Details on the release cycle are available at SAP Security Patch Day. Validate the fix in a non-production landscape before promoting to production transports.

Workarounds

Block or quarantine archive files from untrusted origins before they reach SAP transport directories
Require multi-party review of any archive processed with ctsattach and validate the archive hash against a known-good source
Segment the SAP transport network so that only authorized systems can deliver archive files to production hosts

bash

# Configuration example: restrict access to the SAP transport directory
# Adjust paths and group names to match your SAP installation
chown -R <sid>adm:sapsys /usr/sap/trans
chmod 750 /usr/sap/trans
find /usr/sap/trans -type d -exec chmod 750 {} \;
find /usr/sap/trans -type f -exec chmod 640 {} \;