SAP logo. The November 2026 Patch Day fixes 38 flaws across SAP's product line, including four rated a perfect 10.0. Image: SAP SE, public domain, via Wikimedia Commons.
📌 KEY HIGHLIGHTS
- Four flaws rated 10.0: the maximum CVSS score, all fixed on 10 November 2026 as part of SAP's monthly Security Patch Day. None of the four needs a login, and none needs the victim to click anything.
- Nine critical flaws in all: 38 new CVE records across 34 SAP Security Notes — 9 critical, 15 high, 13 medium and 1 low.
- What the worst ones allow: remote code execution through the Web Dispatcher and Internet Communication Manager, logging in as any user through the SAML2 service provider, and impersonating one of the system's own application servers through SAP Gateway.
- No exploitation confirmed: none of the 38 flaws is in CISA's Known Exploited Vulnerabilities catalogue, and SAP has reported no active attacks. That can change fast — SAP flaws have been exploited within days of past Patch Days.
- Where to get the fixes: each flaw is fixed in its own SAP Security Note, available through SAP for Me / the SAP Support Portal, which needs a customer sign-in. NVD publishes a public page for each CVE.
SAP November 2026 Patch Day explained: the four 10.0 flaws
SAP's Security Patch Day falls on the second Tuesday of every month, and this month it landed on 10 November 2026. The headline is the severity at the top of the list: four flaws rated 10.0 out of 10, the highest possible CVSS score. Three are in the SAP NetWeaver application server — the software SAP systems run on — and one is in the Web Dispatcher, which receives web requests from the internet and passes them to that server.
| CVE | Component | SAP Note | What it allows |
|---|---|---|---|
| CVE-2026-76964 | Internet Communication Manager (ICM), NetWeaver AS ABAP | 3778530 | Crafted WebSocket traffic corrupts memory — remote code execution |
| CVE-2026-89126 | SAP Web Dispatcher | 3778556 | Same memory-corruption root cause — remote code execution |
| CVE-2026-89103 | SAP Gateway | 3798345 | Outsider treated as one of the system's own application servers |
| CVE-2026-120017 | SAML2 service provider, NetWeaver AS ABAP and ABAP Platform | 3849308 | Login assertions not verified — log in as any user, including admins |
The two code-execution flaws share a root cause: WebSocket control frames with invalid length fields cause a heap out-of-bounds write before any login. The Web Dispatcher flaw affects standalone and embedded Web Dispatchers, including those in SAP HANA XS Classic and XS Advanced — but not SAP Content Server. In both cases, crafted network traffic can corrupt memory, and an attacker who succeeds can run code and fully compromise the system.
The SAML2 flaw (CVE-2026-120017) is different but just as serious. The SAML2 service provider hands user sign-in to an identity provider; on affected setups it did not check the signatures on incoming assertions. An attacker could bypass authentication and impersonate arbitrary users — including privileged accounts — on systems that use SAML single sign-on, such as Fiori Launchpad or Web GUI behind an identity provider.
The Gateway flaw (CVE-2026-89103) abuses the way SAP Gateway decides which outside programs may connect. Where its access-control lists hold no explicit rules, the gateway falls back to a default list with high privileges, letting an external attacker be treated as one of the system's own application servers. The fix adds a profile parameter, gw/acl_mode_proxy, that tightens the default rules on older kernels.
The other five critical flaws
The four 10.0 flaws are not the whole story. Five more flaws in this Patch Day score 9.0 or higher — and three of them need only low-privilege access to start with:
| CVE | Score | Flaw | SAP Note |
|---|---|---|---|
| CVE-2026-76965 | 9.9 | Missing authorisation on an internal function — OS command injection (NetWeaver AS ABAP) | 3792735 |
| CVE-2026-109795 | 9.9 | Missing authorisation and code injection through a remote interface (S4CRM) | 3834842 |
| CVE-2026-109803 | 9.9 | Unrestricted XSL transformation — arbitrary code execution (NetWeaver Knowledge Management) | 3809153 |
| CVE-2026-89119 | 9.6 | Cross-site request forgery in an admin function (Web Dispatcher / ICM) | 3804858 |
| CVE-2026-109798 | 9.1 | XML external entity injection (BusinessObjects Web Intelligence) | 3799117 |
SAP headquarters in Walldorf, Germany. SAP's monthly Patch Day is the main route for critical NetWeaver and Web Dispatcher fixes. Photo: Wikimedia Commons, CC BY 2.0.
Why it matters for Indian readers
SAP runs the core systems of a large share of Indian enterprise IT — manufacturing, IT services, banks and public-sector organisations all run NetWeaver-based landscapes, and many expose a Web Dispatcher or Gateway to the internet so employees and partners can reach Fiori apps. Those internet-facing systems are the ones to patch first: the two code-execution flaws need only network access, no login and no user action.
No India-specific exploitation of these flaws has been reported, and no CERT-In advisory for this Patch Day was found at the time of writing — Indian admins should follow SAP's notes directly rather than wait for a local notice. This is also the third month running with a 10.0 at the top of SAP's Patch Day, after September's OVERPASS flaw and an October 10.0 in the SAP Cloud SDK for Python. The same week has already brought other actively exploited enterprise flaws onto CISA's list, including IBM Aspera Faspex CVE-2026-123218 and SonicWall CVE-2026-19868 — November's patch cycle is a busy one across vendors, not just SAP.
Should you care?
✅ Act now if your organisation runs SAP NetWeaver, Web Dispatcher, ICM or Gateway — especially anything internet-facing. Four of the flaws need no login at all, and the fixes are already published. ⏳ Lower priority if you do not run SAP software: there is nothing for home users to patch. But the lesson travels — if any of your vendors publishes a monthly patch day, treat its 10.0-rated items as same-week work, not next-quarter work.
What to do now
1. Inventory first. List every NetWeaver AS ABAP system, Web Dispatcher, ICM and Gateway instance — including embedded Web Dispatchers in SAP HANA XS Classic and XS Advanced. One missed instance leaves the flaw open. 2. Patch in one rollout. Update the kernel and all Web Dispatchers together, to levels that cover all 17 of this month's kernel and Web Dispatcher fixes. 3. Harden the Gateway after patching. Check that gw/acl_mode is 1, that secinfo and reginfo hold explicit rules, and that the Gateway port (33xx) cannot be reached from user networks or the internet. 4. Check the logs. Review every trusted identity provider in transaction SAML2 and look in the audit logs for SAML logons by privileged users from unexpected sources.
FAQs
What is SAP Patch Day?
SAP Patch Day is SAP's monthly security release, on the second Tuesday of each month. SAP publishes Security Notes fixing the month's vulnerabilities; the November 2026 Patch Day, on 10 November, fixed 38 flaws across 34 notes, nine of them critical.
Which SAP flaws were fixed in November 2026?
Four flaws rated 10.0 — CVE-2026-76964 (ICM), CVE-2026-89126 (Web Dispatcher), CVE-2026-89103 (SAP Gateway) and CVE-2026-120017 (SAML2) — plus five more critical flaws rated 9.1 to 9.9 in NetWeaver, S4CRM and BusinessObjects. None of the four 10.0 flaws needs a login to exploit.
Are the SAP November 2026 flaws being exploited?
No exploitation has been confirmed, and none of the 38 flaws appears in CISA's Known Exploited Vulnerabilities catalogue as of the 9 November catalogue version. SAP has also reported no active attacks — but that status can change quickly, and SAP flaws have been exploited within days of past Patch Days.
How do I apply the SAP November 2026 patches?
Apply the SAP Security Notes for the affected components through SAP for Me / the SAP Support Portal, which needs a customer sign-in. Update the kernel and all Web Dispatchers in a single rollout, and confirm the new levels after the restart. Turning off WebSocket support blocks the ICM and Web Dispatcher flaws as a last resort, but it breaks features that depend on it.
Takeaway: Four of SAP's November flaws score a perfect 10.0 and need no login — the kind of flaw that gets probed within days of a Patch Day. The fixes are out; the exposure now depends on how fast admins apply them.
If you run SAP, check your kernel and Web Dispatcher versions against the notes above today — and patch internet-facing systems first.
Sources
- The Hacker News — SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution (10 November 2026)
- SecurityOnline.info — SAP Security Patch Day: 9 Critical SAP NetWeaver Fixes (10 November 2026)
- Brandefense — SAP's November 2026 Patch Day: Six Critical Fixes Compared (10 November 2026)
- SAP — SAP Security Patch Day (official bulletin index; notes need a customer sign-in)
Comments
Post a Comment