SAP NetWeaver CVE-2026-34265

Exploitation requires network access to the SAP NetWeaver ABAP server's DIAG service (the SAP GUI dispatcher, typically TCP 3200/32NN); no authentication, credentials, or user interaction are needed (PR:N/UI:N), so it works against default configurations wherever the DIAG port is reachable by the attacker. The primary limiting factor is therefore network exposure of the DIAG port: environments that firewall the 32NN ports to trusted GUI subnets or route them exclusively through SAProuter/SNC materially shrink the attack surface. The condition is specifically the exposed, pre-authentication DIAG protocol parser - not a non-default feature toggle - meaning any standard AS ABAP installation reachable on its DIAG port is a candidate target.

The signals are strongly aligned toward high priority on the raw-severity axis: CVSS 9.8 with a fully remote, low-complexity, unauthenticated, no-interaction vector (AV:N/AC:L/PR:N/UI:N) against an internet- or intranet-reachable enterprise application server. However, no EPSS score, KEV listing, POC, or SSVC decision data was provided, so the exploitation-likelihood axis is unquantified and should not be presented as high just because CVSS is. Notably, the description hedges the actual demonstrated impact - 'could potentially disclose sensitive system information or crash the system' - which describes info-disclosure and denial-of-service outcomes more concretely than reliable code execution; the vendor-assigned C:H/I:H/A:H may reflect worst-case out-of-bounds-write potential rather than a proven RCE. Verify with SAP whether full integrity/RCE impact is demonstrated or theoretical. Net: treat as a high-priority patch given the exposed unauthenticated attack surface and SAP's history of DIAG/dispatcher bugs being weaponized, but recognize exploitation-in-the-wild is unconfirmed.

An attacker with network reach to an SAP application server's DIAG port (3200/32NN) opens a raw connection and sends a crafted DIAG message with malformed length/type fields that trigger the out-of-bounds write during parsing, before authentication. In the most reliable outcome this crashes work processes and causes a denial of service; with a more sophisticated payload the memory corruption could leak server memory contents or be developed toward code execution. No public POC is identified at time of analysis, so a working exploit would require reverse-engineering the DIAG parser.