SAP November patch day fixes four CVSS 10.0 flaws
Original title: SAP Security Patch Day – Critical SAP NetWeaver, Dispatcher and Gateway Vulnerabilities Patched
Unauthenticated memory corruption in ICM and Web Dispatcher may allow code execution; exploitation is not discussed.
SAP's November 10, 2026 Security Patch Day includes 35 new notes, four GitHub advisories and three updates to earlier notes. Four issues score CVSS 10.0: memory corruption in NetWeaver AS ABAP's Internet Communication Manager and in Web Dispatcher, broken access control in SAP Gateway, and missing authentication in the SAML2 Service Provider. Three further notes score 9.9. SAP urges customers to apply relevant corrections; the report does not mention exploitation.
Unconfirmed: The report does not say whether any of the vulnerabilities are being exploited.
- Note 3778530 covers CVE-2026-76964 in KRNL64UC 7.53 and listed KERNEL releases.
- Note 3849308 covers SAML2 missing authentication in SAP_BASIS releases through 922.
- The four 10.0 vectors require neither credentials nor user interaction.
- The 9.9 issues require low privileges, unlike the unauthenticated maximum-severity flaws.
Impact: Unauthenticated memory corruption could allow arbitrary code execution.
| Product | Affected |
|---|---|
| SAP NetWeaver AS ABAP Internet Communication Manager | KRNL64UC 7.53; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, and 9.20 |
| SAP Web Dispatcher | — |
| SAP Gateway | — |
| SAP NetWeaver AS ABAP SAML2 Service Provider | selected SAP_BASIS releases through 922 |
- 1.Review SAP's security support portal and apply relevant corrections promptly.
- 2.Check individual notes for affected components and deployment instructions.
- CVEs
- CVE-2026-76964CVE-2026-89126CVE-2026-89103CVE-2026-120017CVE-2026-109803CVE-2026-76965CVE-2026-109795CVE-2026-89119CVE-2026-120014CVE-2026-109798CVE-2026-76966CVE-2026-109796CVE-2026-120008CVE-2026-109800CVE-2026-109799CVE-2026-109793CVE-2026-120010CVE-2026-109806CVE-2026-109807CVE-2026-76970CVE-2026-109804CVE-2026-89114CVE-2026-76973CVE-2026-109794CVE-2026-120013CVE-2026-120012CVE-2026-120015CVE-2026-120009CVE-2026-109797CVE-2026-109802
- Vendors
- SAP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76964 | Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP | 10.0 group max | — | ||
| CVE-2026-109795 | Code injection in SAP NetWeaver remote functionality | 9.9 | — | ||
| CVE-2026-109797 | Cross-tenant sandbox access in SAP Astonish Incus backend | 7.1 | — | ||
| CVE-2026-109798 | Authenticated XXE in SAP BusinessObjects Web Intelligence | 9.1 | — | ||
CVE-2026-109799+1 related CVE | Unverified JWT signature in SAP Cloud SDK for Python | 7.5 | — | ||
| CVE-2026-109800 | Authenticated memory-corruption DoS in SAP Web Dispatcher | 7.7 | — | ||
CVE-2026-76966+1 related CVE | Unauthenticated memory corruption via SAP Kernel RFC | 8.9 group max | — | ||
| CVE-2026-109803 | Authenticated code injection via XSL in SAP NetWeaver KM | 9.9 | — | ||
| CVE-2026-109804 | Unauthenticated information disclosure in SAP Message Server | 7.5 | — | ||
CVE-2026-120008+2 related CVEs | Out-of-bounds write in SAP NetWeaver Internet Graphics Service | 8.2 group max | — | ||
| CVE-2026-120009 | Code injection in SAP ABAP Developer Tools (AMDP Data Preview) | 7.2 | — | ||
| CVE-2026-120013 | Path traversal in SAP agent_memory before 0.50.0 | 7.5 | — | ||
| CVE-2026-120014 | CSRF in SAP HANA XSA Web Dispatcher admin functions | 7.6 | — | ||
| CVE-2026-120015 | Untrusted file load in SAP Host Agent | 7.5 | — | ||
CVE-2026-120017+1 related CVE | Authentication bypass in SAP NetWeaver AS ABAP under some configs | 10.0 group max | — | ||
CVE-2026-76970+1 related CVE | Memory corruption DoS in SAP NetWeaver ABAP | 7.5 | — | ||
| CVE-2026-89103 | Incorrect authorization via SAP Gateway default ACL | 10.0 | — | ||
CVE-2026-89126+1 related CVE | Unauthenticated memory corruption in SAP Web Dispatcher | 10.0 group max | — |
From the original article
4 min read at cybersecuritynews.com
SAP’s November 2026 Security Patch Day brings fixes for critical vulnerabilities across SAP NetWeaver, Web Dispatcher, Gateway, and other business applications. Released on November 10, the update includes 35 new security notes, four GitHub security advisories, and three updates to earlier notes. Four vulnerabilities carry the maximum CVSS score of 10.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.