SAP November 2026 notes fix four CVSS 10.0 unauthenticated flaws
Original title: SAP November 2026 Patch Day Fixes Four Maximum-Severity Security Vulnerabilities
The bulletin lists 35 new notes and does not report active exploitation of the patched issues.
On November 10, 2026, SAP released 35 new security notes, four GitHub advisories, and three updates to earlier notes. Four flaws score CVSS 10.0: memory corruption in NetWeaver Internet Communication Manager and Web Dispatcher, broken access control in SAP Gateway, and missing authentication in the SAML2 Service Provider. All four are network-reachable without privileges or user interaction. Three further notes score 9.9, and a BusinessObjects XXE affects ENTERPRISE 430, 2025, and 2027.
Unconfirmed: The bulletin does not state whether any of the November flaws are exploited.
- Python SDK versions before 0.63.1 can spoof tenant or user identity.
- CSRF notes CVE-2026-89119 and CVE-2026-120014 are rated 9.6.
- Revised WebClient UI and GUI for HTML notes still need review.
- SAP urges customers to apply corrections from individual notes.
Impact: Compromise of confidentiality, integrity, and availability
| Product | Affected | Fixed in |
|---|---|---|
| SAP NetWeaver AS ABAP Internet Communication Manager | — | — |
| SAP Web Dispatcher | — | — |
| SAP Gateway | — | — |
| SAP SAML2 Service Provider | — | — |
| SAP BusinessObjects BI Platform Web Intelligence | ENTERPRISE 430, 2025, and 2027 | — |
| SAP Cloud SDK for Python | before 0.63.1 | 0.63.1 |
- 1.Review SAP's security notes portal and apply the November 10, 2026 corrections.
- 2.Update SAP Cloud SDK for Python versions before 0.63.1.
- 3.Match installed component versions against each applicable note.
- CVEs
- CVE-2026-76964CVE-2026-89126CVE-2026-89103CVE-2026-120017CVE-2026-109803CVE-2026-76965CVE-2026-109795CVE-2026-89119CVE-2026-120014CVE-2026-109798CVE-2026-76966CVE-2026-109796CVE-2026-120008CVE-2026-109800CVE-2026-109799CVE-2026-109793CVE-2026-120010CVE-2026-109806CVE-2026-109807CVE-2026-76970CVE-2026-109804CVE-2026-89114
- Vendors
- SAP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-76964+4 related CVEs | Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP | 10.0 group max | — | ||
| CVE-2026-109795 | Code injection in SAP NetWeaver remote functionality | 9.9 | — | ||
| CVE-2026-109798 | Authenticated XXE in SAP BusinessObjects Web Intelligence | 9.1 | — | ||
| CVE-2026-109799 | Unverified JWT signature in SAP Cloud SDK for Python | 7.5 | — | ||
| CVE-2026-109800 | Authenticated memory-corruption DoS in SAP Web Dispatcher | 7.7 | — | ||
| CVE-2026-109803 | Authenticated code injection via XSL in SAP NetWeaver KM | 9.9 | — | ||
| CVE-2026-109804 | Unauthenticated information disclosure in SAP Message Server | 7.5 | — | ||
CVE-2026-120008+2 related CVEs | Out-of-bounds write in SAP NetWeaver Internet Graphics Service | 8.2 group max | — | ||
| CVE-2026-120014 | CSRF in SAP HANA XSA Web Dispatcher admin functions | 7.6 | — | ||
CVE-2026-120017+1 related CVE | Authentication bypass in SAP NetWeaver AS ABAP under some configs | 10.0 group max | — | ||
| CVE-2026-76966 | Unauthenticated memory corruption via SAP Kernel RFC | 8.9 | — | ||
| CVE-2026-76970 | Memory corruption DoS in SAP NetWeaver ABAP | 7.5 | — | ||
| CVE-2026-89103 | Incorrect authorization via SAP Gateway default ACL | 10.0 | — | ||
CVE-2026-89126+1 related CVE | Unauthenticated memory corruption in SAP Web Dispatcher | 10.0 group max | — |
From the original article
5 min read at gbhackers.com
SAP released 35 new security notes and four GitHub security advisories on November 10, 2026, alongside three updates to earlier notes. Four vulnerabilities carry the maximum CVSS score of 10. 0 and affect NetWeaver Internet Communication Manager, Web Dispatcher, SAP Gateway, and the SAML2 Service Provider.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.