EUVD-2026-55859
GHSA-f774-9w9m-r939
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote DIAG parsing bug (AV:N/AC:L/PR:N/UI:N); out-of-bounds write supports A:H and C:H, with I:H retained on worst-case memory-corruption potential though the description mainly demonstrates disclosure and crash.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.
Articles & Coverage 1
AnalysisAI
Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the SAP NetWeaver ABAP server's DIAG service (the SAP GUI dispatcher, typically TCP 3200/32NN); no authentication, credentials, or user interaction are needed (PR:N/UI:N), so it works against default configurations wherever the DIAG port is reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are strongly aligned toward high priority on the raw-severity axis: CVSS 9.8 with a fully remote, low-complexity, unauthenticated, no-interaction vector (AV:N/AC:L/PR:N/UI:N) against an internet- or intranet-reachable enterprise application server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix delivered in SAP security note 3714806 (https://me.sap.com/notes/3714806) as part of the corresponding SAP Security Patch Day (https://url.sap/sapsecuritypatchday) - this is a kernel/SAP_BASIS level correction, so plan for the associated kernel or support-package update and a restart of the affected application servers; exact patched levels are enumerated in the note. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all SAP NetWeaver ABAP instances accessible from untrusted networks and immediately apply firewall rules to restrict DIAG protocol access (ports 3200-3299) to only known, trusted IP ranges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today