What is CVE-2026-34265?
CVE-2026-34265 is a memory corruption vulnerability in the Application Server ABAP component of SAP NetWeaver and the ABAP Platform. The flaw stems from logical errors in how the SAP kernel parses DIAG protocol messages, the proprietary protocol that carries traffic between the SAP GUI presentation layer and the application server. Malformed input reaching the parser leads to an out-of-bounds write, classified as CWE-787.
The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). Exploitation is pre-authentication. An attacker needs network access to the dispatcher service and nothing else, with no credentials, no user interaction, and low attack complexity.
SAP describes the practical impact as disclosure of sensitive system information or a crash of the affected system, with high impact to confidentiality, integrity, and availability. The advisory does not describe code execution, and defenders should treat information disclosure and denial of service as the confirmed impact rather than assuming a fuller compromise. That said, out-of-bounds writes in a long-lived kernel process are the class of defect where impact assessments tend to move in one direction over time, so the absence of a code execution claim today is not a reason to defer the patch.
What assets are affected by CVE-2026-34265?
The vulnerable component is the SAP kernel, not an application-layer add-on, which means the affected surface follows the kernel release rather than the business suite running on top of it. SAP lists KERNEL 7.22, KRNL64NUC 7.22, KRNL64UC 7.22, 7.22EXT, 7.22EXT2, 7.22EXT3, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, and 9.19 as affected. The span from 7.22 to 9.19 covers both long-running legacy landscapes and current S/4HANA-era deployments.
In practice, an affected asset is an ABAP application server running the dispatcher service. The dispatcher listens on TCP/32NN, where NN is the two-digit instance number, so a default single-instance system answers on TCP/3200. Any host reachable on that port and speaking DIAG is in scope. This includes dialog instances behind load balancers, standalone development and quality assurance systems, and application servers in cloud-hosted landscapes where security group rules were written around convenience rather than segmentation.
These assets end up internet-facing more often than SAP architecture guidance would suggest. DIAG was designed for a trusted internal network and predates the assumption that any listening port will eventually be scanned. Remote SAP GUI access is frequently solved by exposing the dispatcher directly instead of routing through SAProuter or a VPN, and those exceptions tend to outlive the projects that created them. Migrations compound the problem: systems are lifted to cloud infrastructure with their port configuration intact, and the temporary external access opened during cutover is rarely revoked.
What does our data show about exposure patterns?
Exposure in this set is led by Communication Services and Information Technology, tied at 27.6% of observed assets each, with Consumer Staples close behind at 25.4%. The distribution is unusually flat. No single sector dominates, and the top three account for more than 80% of observed assets between them.
The concentration reflects how these sectors operate rather than how they patch. Communication Services and Information Technology organizations run large, acquisition-heavy estates where each acquired entity arrives with its own SAP landscape, its own instance numbering, and its own firewall history.
Consumer Staples firms carry a different version of the same problem: geographically distributed manufacturing, warehousing, and distribution sites, each with regional application servers that were provisioned for local access and never reassessed against a central network policy. In all three cases, the exposure is a byproduct of scale and distribution, not of neglect at any single site.
The flatness of the distribution is the more useful signal. When exposure spreads this evenly across unrelated sectors, the driver is rarely sector-specific behavior. It is the underlying deployment pattern. SAP landscapes are built once, documented at build time, and then extended for a decade by teams that inherited them. The dispatcher port is a default, defaults survive migrations, and nobody owns the question of whether a given instance still needs to answer from outside the perimeter.
Are fixes available?
Yes. SAP addressed this vulnerability in Security Note 3714806, released as part of the August 2026 SAP Security Patch Day on August 11, 2026. The correction is delivered as a kernel patch, so remediation means updating the SAP kernel to the fixed patch level for the relevant release rather than applying a transportable note through SNOTE.
The kernel delivery model has practical consequences for scheduling. A kernel update requires an instance restart, which places remediation inside a maintenance window and puts it in contention with change freeze calendars. Landscapes running older releases such as 7.22 and its EXT variants should confirm that their release is still within a support window that provides the corrected kernel, because organizations on extended or custom maintenance agreements may find the fixed patch level is not available to them on the same timeline.
Patch level requirements differ per kernel release and per platform, and the note itself is the authoritative source. Organizations should verify the exact target patch level directly with SAP for every release in their landscape rather than assuming that one fixed level applies across all instances.
Are there any other recommended actions to take?
Alongside patching, defenders should:
- Inventory every ABAP application server and confirm which instances answer on
TCP/32NNfrom outside the perimeter - Restrict dispatcher ports to trusted networks, jump hosts, and administrative subnets
- Route all external SAP GUI access through SAProuter with an explicit permit-only route table
- Enable SNC on SAP GUI connections to authenticate and encrypt DIAG traffic
- Monitor
dev_dispand work process traces for unexplained dispatcher crashes or restarts - Audit cloud security group rules for legacy exceptions that expose SAP instance port ranges
How can CyCognito help your organization?
CyCognito published an Emerging Threat Advisory for CVE-2026-34265 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.
To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.
