SAP Security Patch Day Fixes Nine Critical Flaws in November 2026

TL;DR

SAP published 38 new CVE records on November 10, 2026, as part of its November SAP Security Patch Day. Nine of them are rated Critical, and four carry the maximum CVSS score of 10.0. Most of the worst bugs affect SAP NetWeaver, SAP Web Dispatcher and SAP Gateway.

November’s release fixes 9 Critical, 15 High, 13 Medium and 1 Low severity flaws across 34 SAP Notes. Several Critical bugs let attackers take over a system without logging in. No exploitation has been confirmed, but admins should patch internet-facing SAP systems first.

Notable CVEs

Why It Matters

SAP systems run finance, payroll and supply chains for large companies. As a result, a single takeover can expose a firm’s most sensitive data. Four of this month’s Critical flaws need no authentication at all.

So far, none of the 38 CVEs appears in CISA’s Known Exploited Vulnerabilities catalog. Likewise, SAP has not reported active attacks. Still, CISA’s catalog already lists 14 older SAP flaws that attackers have exploited.

How the Attack Works

Unauthenticated CVSS 10.0 flaws

• CVE-2026-120017: The SAML2 service provider in SAP NetWeaver AS ABAP fails to verify login assertions under certain setups. An attacker “could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts.”
• CVE-2026-89126: Crafted network traffic triggers memory corruption in SAP Web Dispatcher, leading to code execution.
• CVE-2026-76964: A similar memory corruption bug hits the Internet Communication Manager in AS ABAP.
• CVE-2026-89103: SAP Gateway turns on a default access control list with high privileges. In turn, an outside attacker can pass as an internal application server.

Other Critical flaws

Three more bugs score 9.9 and need only low privileges. CVE-2026-76965 allows OS command injection in AS ABAP. CVE-2026-109795 enables code injection through a remote interface, and CVE-2026-109803 abuses XSL transformations in Knowledge Management XML Forms.

Meanwhile, CVE-2026-89119 (CVSS 9.6) is a CSRF flaw in Web Dispatcher and ICM. It requires an admin to click a malicious link. Finally, CVE-2026-109798 (CVSS 9.1) is an XXE bug in BusinessObjects Web Intelligence.

Affected Versions

• SAP NetWeaver AS ABAP and ABAP Platform, SAP_BASIS 702 through 920 (SAML2 flaw)
• SAP Web Dispatcher and kernel releases 7.53, 7.54, 7.77, 7.93 and 9.16 to 9.20
• SAP Gateway on kernel 7.22 through 9.21
• SAP BusinessObjects BI Platform, Host Agent, NetWeaver AS Java and S4CRM components

Each SAP Note lists the exact affected support packages.

Patch and Mitigation

Customers should review the SAP Security Notes for November 2026 and apply the fixes. Start with the four CVSS 10.0 issues on systems reachable from the internet. Next, patch the low-privilege code execution bugs.

Where a patch cannot go in right away, limit network access to SAP Gateway, Web Dispatcher and ICM ports. Also review SAML2 settings on ABAP systems. Since SAP Security Patch Day releases often draw attacker attention, delays carry real risk.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.