# CVE-2026-34265: SAP NetWeaver Application Server ABAP DIAG protocol memory corruption

Source: https://junglewise.ai/threats/cve-2026-34265-sap-netweaver-application-server-abap-diag-protocol-memory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-34265 · Severity: critical · CVSS 9.8 · Published 2026-08-11

SAP NetWeaver Application Server ABAP is a core middleware platform used by many enterprises to run business applications. An unauthenticated remote attacker can exploit logical errors in how the system processes DIAG protocol messages, causing memory corruption. This could allow attackers to crash the system, disrupt business operations, or potentially steal sensitive business data without needing valid credentials.

Technologies: [SAP NetWeaver Application Server ABAP](https://junglewise.ai/threats/technologies/netweaver-application-server-abap). Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-34265 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34265 being exploited in the wild.

**How severe is CVE-2026-34265?** Critical severity, with a CVSS score of 9.8, published 11 August 2026.

**Which products and versions are affected?** SAP NetWeaver Application Server ABAP.

**Is there a fix for CVE-2026-34265?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-34265 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-34265?** Check whether you run SAP NetWeaver Application Server ABAP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in SAP NetWeaver Application Server ABAP's DIAG protocol parser, which handles communication between SAP GUI clients and the application server. An unauthenticated attacker on the network can send specially crafted DIAG protocol packets to exploit logical errors in the parser, triggering memory corruption. No authentication is required to trigger this issue, as the DIAG protocol is exposed at the network level. An attacker can achieve remote code execution, denial of service, or information disclosure by leveraging this memory corruption. SAP has classified this as critical severity (CVSS 9.8) and released patches via their August 2026 Security Patch Day.

## Affected products

- SAP NetWeaver Application Server ABAP

## Timeline

- 2026-08-11: disclosed: Published on SAP Security Patch Day
- 2026-08-11: other: CVE-2026-34265 assigned

## References

- [https://me.sap.com/notes/3714806](https://me.sap.com/notes/3714806)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP Web Dispatcher and NetWeaver Application Server ABAP CSRF in administrative functionality](https://junglewise.ai/threats/cve-2026-89119-sap-web-dispatcher-and-sap-netweaver-application-server-abap)
- [SAP NetWeaver Application Server ABAP memory corruption denial of service](https://junglewise.ai/threats/cve-2026-76970-due-to-a-memory-corruption-vulnerability-in-application-server)
- [SAP NetWeaver Application Server ABAP authorization bypass](https://junglewise.ai/threats/cve-2026-76965-sap-netweaver-application-server-abap-and-abap-platform-does-not)
- [SAP NetWeaver Application Server ABAP memory corruption](https://junglewise.ai/threats/cve-2026-76964-sap-netweaver-application-server-abap-does-not-sufficiently)
- [SAP NetWeaver Application Server ABAP memory disclosure](https://junglewise.ai/threats/cve-2026-109796-sap-netweaver-application-server-abap-and-abap-platform-does-not)