CVE-2026-34265: Unauthenticated Memory Corruption in SAP NetWeaver AS ABAP DIAG Protocol

TL;DR: CVE-2026-34265 is a memory corruption vulnerability in SAP NetWeaver Application Server ABAP that requires no authentication to exploit. An attacker sends crafted requests to the DIAG protocol parser, which handles logical errors incorrectly and corrupts memory. NVD rates this CVSS 9.8 Critical (CWE-787, out-of-bounds write). The impact covers confidentiality, integrity, and availability simultaneously. Every SAP customer running affected NetWeaver AS ABAP versions is exposed.

What the DIAG protocol does and why it is exposed

DIAG is the communication protocol between SAP GUI clients and the SAP NetWeaver Application Server ABAP. Every time a user logs into SAP and opens a transaction, runs a report, or interacts with a screen, DIAG carries that traffic. The protocol handles screen rendering, user input, and control events between the frontend and the ABAP application server.

The vulnerability is in how the server parses DIAG requests. The CVE record states that logical errors in DIAG protocol parsing result in memory corruption. NVD classifies this as CWE-787, an out-of-bounds write. The attacker does not need credentials. The attack vector is network-based with low complexity, no privileges required, and no user interaction needed.

That combination is what makes this CVSS 9.8. An unauthenticated, remote attacker who can reach the DIAG service can corrupt server memory. The impact is high across all three dimensions: confidentiality (sensitive system information disclosure), integrity (data modification), and availability (system crash). This is not a narrow information leak. It is full-stack compromise of the application server.

Who is affected

SAP NetWeaver Application Server ABAP and ABAP Platform. The hol.org CVE record does not list specific fixed versions. The patch is available through SAP Support Note 3714806, released as part of August 2026 SAP Security Patch Day.

The install base is massive. SAP reports over 440,000 customers across 180 countries [4]. SAPinsider tracks more than 100,000 productive NetWeaver installations worldwide [1]. NetWeaver AS ABAP is the runtime foundation for both SAP ECC and SAP S/4HANA, the two most widely deployed ERP platforms on the planet. 99 of the top 100 global companies run SAP [4]. These are Fortune 500 enterprises, government agencies, and global manufacturers whose business processes depend on this server.

SAP NetWeaver 7.5 mainstream maintenance extends to the end of 2027 [3], meaning a large population of customers will remain on affected versions for the foreseeable future. The urgency of patching a 9.8 unauthenticated memory corruption on a server that runs the core business processes of 100,000 installations cannot be overstated.

What to do

SAP released this fix on August 12, 2026 Security Patch Day. Steps:

1. Log in to SAP Support Portal at support.sap.com and locate SAP Note 3714806 for CVE-2026-34265.
2. Apply the support package or patch listed in the note to all NetWeaver AS ABAP instances. Prioritize internet-facing systems first.
3. Restrict network access to the DIAG service. The DIAG protocol (default port 3200 plus instance number, or 3300 for SAP instances) should never be directly reachable from the internet. Use SAProuter, firewalls, or VPN to limit exposure to trusted internal networks only.
4. Review SAP system logs and the DIAG trace files (dev_w* workprocess traces) for evidence of protocol-level anomalies or unexpected memory access patterns that could indicate prior exploitation.
5. If patching is delayed, implement network-level access controls immediately. The unauthenticated nature of this vulnerability means that any network path to the DIAG service is an attack path.

Why it matters

An unauthenticated memory corruption on the primary SAP application server protocol is as severe as it gets in enterprise software. Most SAP vulnerabilities disclosed during Patch Day require at least low privileges. CVE-2026-34265 requires none. The attacker needs only network reachability to the DIAG service.

The DIAG protocol runs on TCP ports 3200-3299 by default (instance number dependent), and in many SAP landscapes these ports are reachable across internal network segments. An attacker who gets a foothold anywhere in the corporate network through a phishing campaign, a compromised endpoint, or a lateral movement vector can target the SAP system directly without needing any SAP credentials.

The CWE-787 classification (out-of-bounds write) combined with the full C/I/A high impact rating means this vulnerability could enable code execution in addition to memory disclosure and denial of service. Memory corruption vulnerabilities in protocol parsers have historically been the basis for reliable remote code execution exploits. The low attack complexity (CVSS AC:L) means exploitation does not require special conditions.

SAP Security Patch Day vulnerabilities in NetWeaver AS ABAP are actively targeted by both financially motivated threat groups and nation-state actors. The concentration of SAP deployments in critical infrastructure (banking, energy, government, manufacturing) makes a CVSS 9.8 unauthenticated vulnerability on this platform a priority for every SAP security team.

Context: what is SAP NetWeaver Application Server ABAP?

SAP NetWeaver Application Server ABAP is the application server runtime for SAP ECC and SAP S/4HANA. It executes programs written in ABAP (Advanced Business Application Programming), SAP's proprietary language. Every SAP transaction, report, and custom program runs on this server.

The server manages transaction processing, database connectivity, user session management, and the DIAG protocol that connects SAP GUI clients to the backend. When SAP personnel talk about "the SAP system running," they mean NetWeaver AS ABAP executing ABAP code and serving client connections over DIAG.

More than 100,000 installations worldwide depend on this server [1]. SAP's broader customer base includes 440,000 organizations across 180 countries [4], with manufacturing, finance, and public sector as the largest verticals. NetWeaver 7.5 remains in mainstream support through 2027 [3], so the affected install base will not shrink significantly before the maintenance deadline.

References

• NVD: CVE-2026-34265
• hol.org: CVE-2026-34265
• SAP Note 3714806
• SAP Security Patch Day
• SAPinsider: SAP NetWeaver [1]
• SAP Architecture Center: NetWeaver Transition [3]
• Houlihan Lokey: SAP Industry Overview 2024 [4]