SAP patches four CVSS 10.0 flaws, including unauthenticated RCE
Original title: SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
The November fixes cover NetWeaver ICM, Web Dispatcher, Gateway, and SAML, and none require user interaction.
SAP’s November Security Patch Day fixes four unauthenticated flaws rated CVSS 10.0. Memory-corruption bugs in Internet Communication Manager and Web Dispatcher can let a network attacker run code. A SAML 2.0 flaw can allow login as any user on some single sign-on systems, and a Gateway flaw can let an outsider impersonate an application server. SAP recommends applying the separate notes as a priority; no exploitation is mentioned.
Unconfirmed: The bulletin does not say whether attackers are exploiting any of the four flaws.
- ICM is CVE-2026-76964, fixed in Note 3778530.
- Web Dispatcher is CVE-2026-89126, fixed in Note 3778556.
- Gateway is CVE-2026-89103, fixed in Note 3798345, with no listed workaround.
- SAML2 is CVE-2026-120017, fixed in Note 3849308, affecting listed SAP_BASIS releases.
- RedRays advises updating kernels and every Web Dispatcher in one rollout.
Impact: Unauthenticated remote code execution or sign-in as any user
| Product | Affected |
|---|---|
| SAP Internet Communication Manager, SAP NetWeaver AS ABAP | KRNL64UC 7.53; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 |
| SAP Web Dispatcher | HDB 2.00; KRNL64UC 7.53; WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 |
| SAP Gateway | KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.22EXT, 7.53, 8.04; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21 |
| SAP SAML2 service provider, SAP NetWeaver AS ABAP and ABAP Platform | SAP_BASIS 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 920, 921, 922 |
- 1.Apply the four SAP security notes as a priority.
- 2.Update kernels and all Web Dispatchers together to levels covering this month’s fixes.
- 3.After the Gateway patch, set gw/acl_mode_proxy where applicable and keep gateway port 33xx off user and internet networks.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120017 | Authentication bypass in SAP NetWeaver AS ABAP under some configs | 10.0 | — | ||
| CVE-2026-76964 | Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP | 10.0 | — | ||
| CVE-2026-89103 | Incorrect authorization via SAP Gateway default ACL | 10.0 | — | ||
| CVE-2026-89126 | Unauthenticated memory corruption in SAP Web Dispatcher | 10.0 | — |
From the original article
4 min read at thehackernews.com
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10. 0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.