SAP disclosed a CVSS 9.8 out-of-bounds write flaw in SAP NetWeaver Application Server ABAP that lets an unauthenticated attacker corrupt memory through malformed DIAG protocol traffic.
What Is It
SAP NetWeaver Application Server ABAP contains logical errors in its parsing of the DIAG protocol. An unauthenticated attacker can exploit these errors to trigger memory corruption, classified as CWE-787 (Out-of-bounds Write). SAP's advisory states the flaw could disclose sensitive system information or crash the system, resulting in high impact to confidentiality, integrity, and availability of the application.
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every precondition an attacker would normally need is absent: the attack is remote over the network, complexity is low, no privileges are required, and no user interaction is involved. The exploitability subscore is the maximum 3.9, with an impact subscore of 5.9.
DIAG is the protocol SAP GUI clients speak to the application server, so the affected listener is exposed anywhere ABAP application servers accept client connections. A crash of the ABAP stack is an availability event for whatever business processes run on it.
What's Vulnerable
SAP NetWeaver and ABAP Platform kernel components. Affected versions listed by SAP:
- KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93
- KRNL64NUC 7.22, KRNL64UC 7.22
- 7.22EXT, 7.22EXT2, 7.22EXT3
- 8.04
- 9.16, 9.18, 9.19
SAP marks the default status for other versions as unaffected. No CPE entries have been published for this CVE yet.
Patch Status
SAP published the fix under SAP Note 3714806, released as part of SAP Security Patch Day. The NVD record remains in "Received" status, meaning NVD analysis is not yet complete; CVSS and CWE data are from SAP as the CNA. Customers should apply the kernel patch referenced in the SAP Note. No workaround is documented in the supplied source material.
Sources
- NVD, CVE-2026-34265: https://nvd.nist.gov/vuln/detail/CVE-2026-34265
- SAP Note 3714806: https://me.sap.com/notes/3714806
- SAP Security Patch Day: https://url.sap/sapsecuritypatchday