Critical SAP NetWeaver and MII Flaws Expose Systems to Memory Corruption and Command Injection

SAP disclosed two high-severity vulnerabilities affecting core enterprise platforms: CVE-2026-34265 in SAP NetWeaver Application Server ABAP and CVE-2026-44758 in SAP Manufacturing Integration and Intelligence (MII). The NetWeaver flaw is an unauthenticated memory corruption issue in DIAG protocol parsing, rated CVSS 9.8, that can allow sensitive information disclosure or system crashes with high impact to confidentiality, integrity, and availability. The MII flaw is a CWE-94 code injection vulnerability affecting XMII 15.4 and 15.5; an attacker with high privileges can exploit insufficient input validation to execute arbitrary commands on the underlying operating system, with a CVSS 9.1 rating.

SAP published fixes in Security Notes 3714806 and 3758900, while reporting indicated no confirmed public exploit or proof-of-concept code at the time of publication and no inclusion in CISA's Known Exploited Vulnerabilities catalog. The disclosures prompted guidance to prioritize patching, limit exposure of the DIAG interface, and review privileged access to MII environments because successful exploitation could disrupt critical SAP operations and expose sensitive enterprise data.