Critical severity · published Aug 11, 2026
CVE-2026-34265
Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver and ABAP Platform · SAP_SE
KRNL64NUC 7.22; 7.22EXT; KRNL64UC 7.22; 7.22EXT2; 7.22EXT3; 7.53; +10 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34265
me.sap.com
https://me.sap.com/notes/3714806
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver and ABAP Platform
10.0
CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability
4.3
CVE-2026-76963
Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform