Loading vulnerability…
Memory Corruption in SAP NetWeaver Application Server ABAP DIAG Protocol Parsing
CVE-2026-34265 is a critical memory corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform. The flaw is caused by logical errors in parsing the SAP DIAG protocol and is described as an out-of-bounds write condition that can corrupt memory during processing of crafted DIAG traffic. The issue is remotely reachable and does not require authentication or user interaction. Affected coverage reported for the vulnerable kernel line spans versions from 7.22 through 9.19. Successful exploitation can lead to disclosure of sensitive system information or termination of the affected service or system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause high-impact compromise of confidentiality, integrity, and availability. An unauthenticated network attacker may trigger memory corruption in the ABAP application server, potentially disclosing sensitive system information from process memory or causing the server to crash. Available reporting specifically confirms information disclosure and denial-of-service outcomes; arbitrary code execution has not been confirmed in the available information.
If you can’t patch tonight, do this now.
Until patching is completed, reduce exposure of the SAP DIAG interface to trusted administrative networks only and block untrusted access to DIAG services at network boundaries. Restrict direct reachability of SAP GUI-to-application-server communication paths, segment ABAP servers from untrusted networks, and monitor for malformed or anomalous DIAG traffic and unexplained SAP application server crashes. These measures only reduce exposure and do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Apply the vendor fix provided by SAP in Security Note 3714806 and update affected SAP NetWeaver AS ABAP and ABAP Platform kernel versions to the corrected release levels. Because the issue affects kernel components, organizations should ensure the patched kernel is deployed consistently across all affected instances and landscapes, including production, test, standby, and disaster-recovery environments, and verify that running versions reflect the corrected build after maintenance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.