CVE-2008-0244: SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and o...

Security readout for executives and security teams

CVE-2008-0244 is a remote command execution flaw in SAP MaxDB 7.6.03 build 007 and earlier. A remote attacker could inject shell metacharacters into MaxDB commands that are later executed through cons.exe. For an exposed legacy MaxDB server, this could mean full host compromise. Exposure is most likely in organizations still running SAP MaxDB 7.6.03 build 007 or earlier, especially where the database service is reachable from untrusted networks. The bundled affected-product metadata is incomplete, so version inventory matters more than relying on scanner CPE matching alone. Prioritize immediately if any affected MaxDB instance remains reachable beyond tightly controlled administrative networks. The age of the CVE lowers likelihood in modern estates, but surviving legacy exposure creates a severe compromise path. Mitigation focus: Identify and retire SAP MaxDB 7.6.03 build 007 or earlier deployments.; Check SAP or vendor guidance for the supported fixed version.; Block untrusted network access to MaxDB management and database interfaces..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.