Critical SAP Quotation Management Flaws (CVE‑2019‑17571 & CVE‑2026‑27685) Enable Remote Code Execution and Insecure Deserialization
What It Is — SAP has issued emergency patches for two high‑severity vulnerabilities in its Quotation Management Insurance (FS‑QUO) module. CVE‑2019‑17571 is a code‑injection flaw (CVSS 9.8) that can lead to arbitrary code execution, while CVE‑2026‑27685 is an insecure‑deserialization issue (CVSS 9.1) that also permits remote code execution.
Exploitability — Both CVEs are publicly disclosed with proof‑of‑concept code circulating in underground forums. Active exploitation has been reported in the wild, and the vulnerabilities are trivial to weaponize against unpatched SAP environments.
Affected Products — SAP Quotation Management Insurance (FS‑QUO) component, part of the broader SAP ERP suite used by insurers, financial services firms, and large enterprises worldwide.
TPRM Impact — The flaws expose downstream customers to ransomware injection, data theft, and service disruption via a trusted supply‑chain provider. Compromised SAP instances can be leveraged to pivot into partner networks, amplifying third‑party risk.
Recommended Actions —
- Verify patch deployment on all SAP FS‑QUO instances immediately.
- Conduct a rapid inventory of any third‑party applications that integrate with the affected SAP module.
- Perform penetration testing or a focused vulnerability scan on the SAP environment to confirm remediation.
- Update third‑party risk registers to reflect the elevated exposure and communicate the issue to affected business units.
Source: The Hacker News