SURIQ
SAP's August 2026 Security Patch Day ships a stack of notes, but one deserves attention before the others: CVE-2026-34265, a memory corruption flaw in the SAP NetWeaver Application Server ABAP that an attacker can trigger with no login at all. SAP scored it 9.8 out of 10. What pushes it to the top of the queue is not the number. It is where the bug lives.
The flaw sits in how the application server parses DIAG, the Dynamic Information and Action Gateway protocol that SAP GUI desktop clients use to talk to the server. The dispatcher answers that traffic on a TCP port in the 3200 range before a user has entered a username. According to SAP's CVE record, an unauthenticated attacker can send malformed DIAG traffic that corrupts memory inside the parser. SAP says the result can leak sensitive data out of the server or take the system down.
Why this one ranks above the rest of the patch day
Most SAP notes gate on some access: a valid user, a role, a reachable RFC destination. This one does not. The CVSS breakdown reads network reachable, low attack complexity, no privileges required, and no user interaction. In plain terms, exposure here is a networking question, not an authorization question. If an attacker can open a TCP session to your dispatcher port, they can reach the vulnerable code.
That reframes who is at risk. It is not only your named SAP users. It is anyone with a path to the DIAG port: a flat corporate network, a firewall rule that drifted open, a VPN segment that reaches production, a cloud security group that exposed 3200 to the world. We made the same point about SAP's July notes, where the highest-scored flaw was not the one to patch first. Read the access vector, not just the score.
The impact, stated honestly
SAP describes two concrete outcomes: sensitive data read out of memory, and a full crash of the server. The CVSS vector rates confidentiality, integrity and availability all high. Memory corruption bugs of this class sometimes carry a path to code execution, but SAP's own text stops at disclosure and denial of service, so that is where we stop too. A crash of the central dispatcher takes the whole application server down, not one session, which makes availability the impact most operators will feel first.
On exploitation: at the time of writing there is no public proof of concept, no report of exploitation in the wild, and the CVE is not on CISA's Known Exploited Vulnerabilities list. That is the good news, and it is also the window. Unauthenticated, network-reachable SAP flaws tend to attract exploit development quickly once the note is public, because the patch itself points researchers at the changed code.
Affected SAP Kernel release levels
The fix ships as an SAP Kernel patch. The CVE record names the following kernel release levels as affected. Match your running kernel against this list, then confirm the exact fixed patch level in SAP Note 3714806.
| Kernel component | Affected release levels |
|---|---|
| KRNL64NUC | 7.22, 7.22EXT |
| KRNL64UC | 7.22, 7.22EXT2, 7.22EXT3 |
| SAP Kernel | 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19 |
Because the vulnerable code is in the kernel, the note covers NetWeaver AS ABAP and the ABAP Platform broadly, not a single application. A system is only as patched as its kernel, so an estate with mixed kernel levels needs each instance checked, not just the central one.
How you would know someone is probing it
Because this is pre-authentication memory corruption, the earliest signal is not in your SAP audit log, which mostly records authenticated activity. It is in the health of the dispatcher and work processes. Watch for these on your SAP application servers:
- Unexpected dispatcher or work process restarts, and core dumps written to the work directory, which is what a failed corruption attempt often looks like from the outside.
- ABAP short dumps or system log entries around DIAG handling that appear with no matching user session.
- New or unusual inbound connections to the dispatcher port from hosts that are not sanctioned SAP GUI clients or jump servers.
A managed detection service watching those hosts can correlate the crash-and-restart pattern with the anomalous inbound connections as one signal, which is the tell for someone testing an unauthenticated flaw rather than a routine fault. The aim is to close the gap between the patch landing and knowing whether anyone tried the door before you shut it.
Patch the kernel, then lock down the port
Two actions, in order:
- Apply the kernel patch. Update the SAP Kernel to the fixed level in SAP Note 3714806, per the August 2026 Security Patch Day guidance. Prioritize any instance whose dispatcher port is reachable from outside a trusted segment.
- Shrink the network exposure. The DIAG dispatcher port should never face the public internet. Restrict it to the networks your SAP GUI clients and administrative jump hosts actually use, through firewall rules, a SAProuter, or cloud security groups. This does not replace the patch, but it removes the easy path while you roll the kernel across every instance.
SAP shops rarely patch a kernel on a whim, because it means a restart and a change window. This is the flaw that earns the emergency window. An unauthenticated bug in the protocol your clients speak to the server, in software that runs the finance and logistics of a large share of the world's enterprises, is exactly the kind that does not stay theoretical for long.