SAP NetWeaver AS ABAP Memory and Command Flaws

Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

DOM-based reflected Cross-Site Scripting in SAP NetWeaver Application Server ABAP enables an authenticated attacker to craft a malicious URL and distribute it to other authenticated SAP users. When a victim accesses the link, unsanitized input is reflected and executed within the DOM in the victim's browser, resulting in high confidentiality impact - such as session token or credential theft - and low integrity impact. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the high confidentiality component.

OS command injection in SAP NetWeaver Application Server ABAP and ABAP Platform enables an attacker holding high-privilege credentials to bypass missing security controls on an internal ABAP code path and execute arbitrary commands on the underlying operating system. Affected releases span kernel versions 7.22 through 9.16, placing a broad range of production SAP landscapes at risk of service disruption or unauthorized OS-level writes. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high availability impact (A:H) makes it a meaningful patch priority for SAP Basis teams.