CVE-2026-34265

Published Aug 11, 2026

Last updated 7 days ago

CVSS critical 9.8
SAP
onapsis

Overview

Description
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.
Source
cna@sap.com
NVD status
Received

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

cna@sap.com
CWE-787

Social media

Hype score
Not currently trending

  1. Warning: multiple critical code injection, out-of-bounds write in #SAP #commercecloud #netweaver #MII CVE-2026-58231, CVE-2026-44772, CVE-2026-34265 & CVE-2026-44758 CVSS: 10-9.1 The first one is actively exploited #Patch #Patch #Patch

    @CCBalert

    18 Aug 2026

    238 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 NUEVA CVE: CVE-2026-34265 — SAP NetWeaver AS ABAP (Memory Corruption) ⚠️ CVSS 9.8 (CRÍTICO) · publicada el 11/08/2026 Afectados: Instâncias SAP NetWeaver AS ABAP expostas à internet Atacante https://t.co/Wmfccln8E0

    @Douglas01284182

    13 Aug 2026

    7 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨 NOVA CVE: CVE-2026-34265 — SAP NetWeaver AS ABAP (Memory Corruption) ⚠️ CVSS 9.8 (CRÍTICO) · publicada em 11/08/2026 Afetados: Instâncias SAP NetWeaver AS ABAP expostas à internet Atacante nã https://t.co/a3vNJUPPwZ

    @Douglas01284182

    13 Aug 2026

    7 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. SAPの定例セキュリティ更新。SAP Commerce CloudのData Hub AdapterにおけるCVE-2026-58231がCVSSスコア10。SAP Manufacturing Integration and IntelligenceのCVE-2026-44772がCVSSスコア9.9。NetWeaverのメモリ破壊CVE-2026-34265がCVSSスコア9.8。 https://

    @__kokumoto

    12 Aug 2026

    602 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

Related CVEs

  1. SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.•CVE-2026-58231
  2. SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability of the application.•CVE-2026-44758
  3. SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.•CVE-2026-44761
  4. Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.•CVE-2026-27690
  5. SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability. This has high impact on confidentiality, integrity, and availability of the application.•CVE-2026-44747

References

Sources include official advisories and independent security research.