SAP_SE SAP NetWeaver and ABAP Platform: memory corruption

SAP_SE SAP NetWeaver and ABAP Platform

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the…

Still cooking for SAP NetWeaver and ABAP Platform.

First seen: 13 Nov 2026
Last update: 13 Nov 2026, 07:17 UTC
Identifiers: CVE-2026-34265
CVSS: 9.8
Source: news
On the menu as: Enterprise apps

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## SAP_SE SAP NetWeaver and ABAP Platform: memory corruption
Severity: critical. Patch status: fix status unknown.
Affected: SAP_SE SAP NetWeaver and ABAP Platform
Ids: CVE-2026-34265

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the…

## Steps
1. This touches infrastructure (erp). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. SAP NetWeaver and ABAP Platform 9.19.x, 9.18.x, 9.16.x, 8.4.x, 7.93.x, 7.89.x, 7.77.x, 7.54.x, 7.53.x, 7.22.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| SAP NetWeaver and ABAP Platform 7.22 to 9.19 (10 lines) | not named in the CVE record | check the vendor advisory: https://url.sap/sapsecuritypatchday | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-34265") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://me.sap.com/notes/3714806 https://nvd.nist.gov/vuln/detail/CVE-2026-34265
https://pwned.coffee/i/sap-netweaver-application-server-abap-allows-an-unauthen-cve-2026-34265

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
SAP NetWeaver and ABAP Platform 7.22EXT to 9.19 (10 lines) fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 13 Nov
The CVE record names no fix for 10 lines; the vendor’s advisory may: url.sap
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA sap) for CVE-2026-34265
Last checked: 13 Nov 2026, 07:21 UTC

Product	Affected	Fixed in	Source
SAP NetWeaver and ABAP Platform	7.22EXT to 9.19 (10 lines)	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 13 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee