Summary

CVE-2026-34265

CVE-2026-34265 is a critical vulnerability in the SAP NetWeaver Application Server ABAP DIAG protocol parsing logic. An unauthenticated attacker can exploit this flaw to cause memory corruption, potentially leading to unauthorized disclosure of sensitive system information or a denial-of-service condition affecting system availability.

Affected products:

• NetWeaver Application Server ABAP

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-34265

CVE-2026-44758

SAP Manufacturing Integration and Intelligence (MII) is susceptible to a command injection vulnerability due to insufficient input validation. An attacker with high-level privileges can supply crafted input that results in arbitrary operating system command execution, potentially compromising the confidentiality, integrity, and availability of the affected system.

Affected products:

• Manufacturing Integration and Intelligence (MII)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-44758

CVE-2026-44763

SAP Manufacturing Integration and Intelligence is susceptible to a path traversal vulnerability due to insufficient validation of file paths in certain functions. A privileged attacker can use specially crafted input to write files to arbitrary locations on the host system. Successful exploitation requires a secondary interaction by a legitimate user and compromises the confidentiality, integrity, and availability of the affected system.

Affected products:

• Manufacturing Integration and Intelligence

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-44763

CVE-2026-44764

SAP Manufacturing Integration and Intelligence is vulnerable to a missing authorization check in the Cost Servlet, allowing an unauthenticated attacker to manipulate business data. By sending crafted requests with specific parameter values, an attacker can perform unauthorized read, create, modify, or delete operations, impacting the overall system confidentiality, integrity, and availability.

Affected products:

• Manufacturing Integration and Intelligence

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-44764

CVE-2026-44765

SAP Manufacturing Integration and Intelligence contains a missing authorization check vulnerability allowing unauthenticated remote attackers to interact with scheduling functions. Exploitation allows for the unauthorized retrieval, creation, modification, or deletion of application-managed scheduling data.

Affected products:

• Manufacturing Integration and Intelligence

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-44765

CVE-2026-58230

SAP Approuter contains a vulnerability where insufficient validation of token content under specific, non-default configurations allows an unauthenticated attacker to redirect sensitive credential material to an attacker-controlled destination. While exploitation requires high complexity due to prerequisite environmental conditions, successful execution leads to a high impact on confidentiality.

Affected products:

• Approuter

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58230

CVE-2026-58243

SAP ABAP Development Tools fails to perform adequate authorization checks, enabling low-privileged users to execute unauthorized database operations against SAP NetWeaver AS ABAP. This vulnerability allows an attacker to read or modify sensitive application data and disrupt service availability, posing a high risk to confidentiality, integrity, and availability.

Affected products:

• ABAP Development Tools
• NetWeaver AS ABAP

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58243