AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SAPCVE-2026-34265

SAP NetWeaver and ABAP Platform: memory corruption

SAP

CVE-2026-34265 · Published Aug 11, 2026 · updated Aug 26, 2026

Critical9.8
No fix yet
SAP advisory

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.

Affected versions

PackageAffectedFixed in
SAP NetWeaver and ABAP Platform
Product
<= KRNL64NUC 7.22No fix yet
<= 7.22EXTNo fix yet
<= KRNL64UC 7.22No fix yet
<= 7.22EXT2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-787

More SAP advisories

All SAP
Critical 10.0Aug 11SAP Commerce Cloud (Data Hub Adapter): remote code executionCVE-2026-58231no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): improper signature checkCVE-2026-66776no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): path traversalCVE-2026-66777no fix yetMedium 5.3Aug 11SAP Approuter does not sufficiently sanitize certain request headers before...CVE-2026-66778no fix yetMedium 6.3Aug 11SAP NetWeaver Application Server ABAP: cross-site scriptingCVE-2026-66779no fix yetHigh 7.9Aug 11SAP BusinessObjects Business Intelligence Platform (Central : hard-coded keyCVE-2026-66763no fix yet