Loading story…
SAP disclosed two high-severity vulnerabilities affecting core enterprise platforms: CVE-2026-34265 in SAP NetWeaver Application Server ABAP and CVE-2026-44758 in SAP Manufacturing Integration and Intelligence (MII). The NetWeaver flaw is an unauthenticated memory corruption issue in DIAG protocol parsing, rated CVSS 9.8, that can allow sensitive information disclosure or system crashes with high impact to confidentiality, integrity, and availability. The MII flaw is a CWE-94 code injection vulnerability affecting XMII 15.4 and 15.5; an attacker with high privileges can exploit insufficient input validation to execute arbitrary commands on the underlying operating system, with a CVSS 9.1 rating.
SAP published fixes in Security Notes 3714806 and 3758900, while reporting indicated no confirmed public exploit or proof-of-concept code at the time of publication and no inclusion in CISA's Known Exploited Vulnerabilities catalog. The disclosures prompted guidance to prioritize patching, limit exposure of the DIAG interface, and review privileged access to MII environments because successful exploitation could disrupt critical SAP operations and expose sensitive enterprise data.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
The SAP CNA newly received CVE-2026-44758 for a code injection vulnerability in SAP Manufacturing Integration and Intelligence affecting XMII 15.4 and 15.5. The issue allows a high-privileged attacker to submit crafted input that can lead to arbitrary operating system command execution.
The SAP CNA newly received CVE-2026-34265 for a memory corruption vulnerability in SAP NetWeaver Application Server ABAP caused by logical errors in DIAG protocol parsing. The flaw can be exploited remotely without authentication and may disclose sensitive information or crash the system.
A source states that the CVE records for the SAP NetWeaver ABAP memory corruption flaw and the SAP MII code injection flaw became publicly available on August 10-11, 2026. The disclosures identified affected products, impact, and SAP references for remediation.
SAP published remediation guidance for the two vulnerabilities via Security Note 3714806 for SAP NetWeaver Application Server ABAP and Security Note 3758900 for SAP Manufacturing Integration and Intelligence. A source states the SAP security notes were published on August 10-11, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP disclosed **CVE-2026-44747**, a critical memory corruption vulnerability in **SAP NetWeaver Application Server ABAP**, and published remediation guidance in **Security Note `3747367`** as part of its Security Patch Day materials. The flaw is classified as **CWE-787** and affects multiple SAP ABAP kernel releases, including `KRNL64NUC 7.22`, `7.22EXT`, `KRNL64UC 7.22`, `7.53`, `7.54`, `7.77`, `7.89`, `7.93`, and `9.16` through `9.20`. The vulnerability can be exploited remotely by an authenticated attacker with low privileges and carries a **CVSS v3.1 score of 9.1** (`AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`). Successful exploitation could cause unauthorized data access, data modification, privilege escalation, or system unavailability. Public reporting said there was **no confirmed active exploitation** at the time of disclosure, but the impact profile makes patching affected SAP environments a priority.
Jul 23, 2026
SAP released Security Patch Day updates to fix multiple newly disclosed vulnerabilities across its product portfolio, including **two critical** and **six high-severity** issues affecting SAP NetWeaver Application Server ABAP, SAP Manufacturing Integration and Intelligence, ABAP Developer Tools, BusinessObjects Business Intelligence Platform Central Management Server, and the SAP Business AI Platform Approuter `node.js` package. The vulnerabilities span arbitrary code execution, arbitrary file write, denial of service, tampering, and information disclosure, and SAP urged customers to apply the relevant security bulletins and product updates. Among the disclosed flaws, **`CVE-2026-58243`** affects **SAP ABAP Developer Tools** and carries a **CVSS 8.8** rating. The vulnerability stems from **missing authorization checks** (`CWE-862`) that can let a low-privileged attacker perform unauthorized database operations against **SAP NetWeaver AS ABAP** over the network. Successful exploitation could expose sensitive data, alter application data, and disrupt legitimate user access. SAP identified affected **SAP_BASIS** versions as `750`, `751`, `752`, `753`, `754`, `755`, `756`, `757`, `758`, `816`, `918`, and `920`, and recommended patching, tightening database operation permissions, limiting user privileges, and monitoring logs for unauthorized activity.
Aug 12, 2026
SAP released multiple security updates addressing critical vulnerabilities across core enterprise products, including **SAP NetWeaver**, **SAP S/4HANA**, **SAP Commerce Cloud**, **SAP Business Warehouse**, **SAP Business Planning and Consolidation**, **SAP Kernel**, **ABAP Platform**, **SAP NetWeaver Application Server Java**, and **SAP Forecasting & Replenishment**. The fixes covered at least 15 vulnerabilities in both the April-to-June advisories, with several flaws rated **critical** and carrying CVSS scores from **9.0 to 9.9**. Reported impacts included **SQL injection**, **remote code execution**, **operating system command execution**, **directory traversal**, **memory corruption**, **sensitive data exposure**, **denial of service**, privilege abuse, and potential full compromise of confidentiality, integrity, and availability. Among the most severe issues, **CVE-2026-27681** affected SAP Business Planning and Consolidation and SAP Business Warehouse, allowing a low-privileged authenticated attacker to upload a file containing SQL commands and execute arbitrary database operations; SAP said a temporary mitigation was to revoke the `S_GUI` authorization object with Activity 60 (Upload) where possible. Additional high-risk flaws included **CVE-2026-34260** and **CVE-2026-34263** in SAP S/4HANA, SAP Commerce Cloud, and SAP Forecasting & Replenishment, each scored **9.6**, as well as critical June issues in NetWeaver-related components that could enable unauthorized access, file-processing abuse, and system compromise. SAP and national defenders urged organizations to apply vendor-specified patches immediately.
Jul 24, 2026