SAP November 2026 Patch Day: Four CVSS 10.0 Flaws in NetWeaver ICM, Web Dispatcher, SAP Gateway and SAML2, and the Versions to Check
SAP's November 10, 2026 patch day fixes four flaws rated CVSS 10.0 that need no login, in the ICM, Web Dispatcher, SAP Gateway and the ABAP SAML2 Service Provider. Here are the notes, the exact affected versions and what to do this week.
Where Worldwide
On this page 8 sections
SAP released 35 new security notes on Tuesday, November 10, 2026, and four of them carry the highest possible severity score, CVSS 10.0. All four can be attacked over the network without a login, and they sit in parts of SAP that many companies expose to other systems or the internet: the Internet Communication Manager, SAP Web Dispatcher, SAP Gateway and the SAML2 single sign-on component of AS ABAP.
If your business runs SAP for finance, supply chain, HR or sales, these notes belong at the top of this month's maintenance list. This post sets out what SAP has confirmed, what it has not said, and the exact versions SAP lists as affected.
What SAP released on November 10, 2026
According to SAP's own November 2026 Security Patch Day page, the release contains 35 new security notes, 4 GitHub security advisories and 3 updates to notes published earlier. SAP asks customers to prioritize these patches.
The CVE records for the four maximum-severity flaws were published by SAP, acting as its own CVE numbering authority, on November 10, 2026. Each carries the same CVSS 3.1 vector: network attack, low complexity, no privileges, no user interaction, and high impact on confidentiality, integrity and availability.
The four CVSS 10.0 SAP vulnerabilities
The versions below are copied from SAP's patch day page. They are individual releases, not ranges: if a release is not listed, SAP does not list it as affected by that note.
| SAP Note | CVE | Component | Affected versions as SAP lists them | What goes wrong |
|---|---|---|---|---|
| 3778530 | CVE-2026-76964 | SAP NetWeaver AS ABAP (Internet Communication Manager) | KRNL64UC 7.53; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 | Crafted network traffic causes memory corruption that could allow code execution, no login needed |
| 3778556 | CVE-2026-89126 | SAP Web Dispatcher | WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20; KRNL64UC 7.53; HDB 2.00; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1 | Heap-based buffer overflow from crafted traffic, could allow code execution, no login needed |
| 3798345 | CVE-2026-89103 | SAP Gateway | KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.22EXT, 7.53, 8.04; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21 | A default access control list with high privileges can make an outside attacker look like an internal application server |
| 3849308 | CVE-2026-120017 | SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) | SAP_BASIS 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 920, 921, 922 | Incoming authentication assertions are not checked well enough in some configurations, so an attacker could log in as any user, including administrators |
Two details are easy to miss. For Web Dispatcher, the WEBDISP package itself is listed only at 7.53, 7.54, 7.77, 7.93 and 9.16; the 9.18 and 9.20 entries apply to the KERNEL package. For SAP Gateway, KERNEL 9.18 is not on the list, while 8.04 and 9.21 are.
What is confirmed and what is not
Confirmed by SAP: the four notes, their CVE numbers, the 10.0 scores and the affected versions above. SAP's CVE records describe each as exploitable by an unauthenticated attacker over the network. For the SAML2 flaw, the record says a successful attack could fully compromise the system and could affect connected systems.
Not stated by SAP: SAP's patch day page does not say whether any of these flaws are being exploited. We found no primary source confirming attacks or public exploit code at the time of writing. The SAML2 record says the problem appears "under certain configurations" but does not name them. The fixed kernel and support package levels are in the SAP notes themselves, which sit behind an SAP customer login; we have not seen them, so check each note for your own release.
The absence of known attacks is not a reason to wait. SAP flaws with public details have been turned into working attacks quickly in the past, and every one of these four needs nothing more than network access.
The other critical SAP notes this month
SAP rated several more notes Critical on the same day:
- Note 3792735, CVE-2026-76965 (CVSS 9.9): OS command injection in the ABAP Application Server. SAP lists KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.22EXT, 7.53; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16.
- CVE-2026-109803 (CVSS 9.9): code injection in Knowledge Management XML Forms.
- CVE-2026-109795 (CVSS 9.9): missing authorization check in S4CRM.
- Note 3804858, CVE-2026-89119 and CVE-2026-120014 (CVSS 9.6): cross-site request forgery in Web Dispatcher and the Internet Communication Manager. SAP lists WEBDISP 7.93, 9.16; XS_ADVANCED_RUNTIME 1.00; KERNEL 7.93, 9.16, 9.20, 9.21.
- CVE-2026-109798 (CVSS 9.1): XML external entity flaw in BusinessObjects Web Intelligence.
SAP also lists a long run of High-rated notes, including memory corruption in the Message Server and Internet Graphics Service, and a JWT signature check flaw in the SAP Cloud SDK for Python.
Why this matters for a company network
SAP systems hold the records a business cannot afford to lose or have altered: invoices, payroll, supplier contracts, customer orders. The components hit this month are the ones that handle traffic coming in. Web Dispatcher often sits at the edge as a reverse proxy, the ICM serves web and API requests for AS ABAP, SAP Gateway handles calls between SAP and other programs, and SAML2 is how staff log in through a company identity provider.
A flaw that lets an outsider pretend to be an administrator, or run code on the server, turns one SAP host into a doorway to everything connected to it. Kernel updates also tend to need a planned restart, so if your SAP partner schedules work quarterly, ask now whether this month can be an exception.
What to do this week
- List your SAP systems. Include Web Dispatcher instances, SAP HANA with XS Advanced, and older 7.22 kernels that may still run in the background.
- Check the kernel release and patch level on each system, for example in transaction SM51 or with the kernel's version output, and compare it to the tables above.
- Check the SAP_BASIS release (System, then Status) against note 3849308, and find out whether SAML2 single sign-on is enabled.
- Open notes 3778530, 3778556, 3798345 and 3849308 in the SAP support portal and record the fixed patch level each one names for your release.
- Schedule the kernel update for affected systems. One kernel update can cover several of this month's notes, but confirm that against each note.
- Limit exposure until patched. Make sure SAP Gateway and ICM ports are reachable only from systems that need them, and that only Web Dispatcher faces the internet, if anything does.
- Review the other Critical notes (3792735 and 3804858 plus the KM XML Forms, S4CRM and BusinessObjects notes) if you run those products.
- Write down who owns this. If an outside partner patches SAP for you, get the date of the update in writing.
SAP November 2026 patch day questions people are asking
Are the SAP November 2026 vulnerabilities being exploited?
SAP's patch day page does not say. We found no primary source confirming attacks at the time of writing. Treat them as urgent anyway, because all four need no login.
Which SAP vulnerabilities are rated CVSS 10.0 this month?
CVE-2026-76964 (ICM, note 3778530), CVE-2026-89126 (Web Dispatcher, note 3778556), CVE-2026-89103 (SAP Gateway, note 3798345) and CVE-2026-120017 (SAML2 Service Provider, note 3849308).
Is SAP Web Dispatcher 9.18 affected?
SAP lists the WEBDISP package at 7.53, 7.54, 7.77, 7.93 and 9.16. The 9.18 and 9.20 entries in note 3778556 are for the KERNEL package. Check which package your Web Dispatcher runs from.
Does the SAML2 flaw affect every SAP_BASIS release?
No. SAP lists SAP_BASIS 702, 731, 740, 750 through 758, 816, 920, 921 and 922. SAP also says it applies "under certain configurations", which it does not describe publicly.
Where do I find the fixed versions?
In each SAP note on the SAP support portal. The notes need an SAP customer login.
What if we cannot patch right away?
Restrict network access to SAP Gateway, the ICM and Web Dispatcher, and check each note for a workaround. Network limits reduce risk but do not replace the patch.
The bigger lesson
The most valuable system in a business is often the one patched least often, because updating it feels risky. This month's SAP release shows why that habit is a gamble: four doors rated 10.0, none of them needing a password. Every system that runs the business needs a named owner, a patch schedule and a way to check versions in minutes, not weeks.
See how we approach this at security hardening, or ask us for a quote.
Get security alerts like this one by email, with our free checklist, at security alerts.
Sources: SAP Security Patch Day, November 2026; CVE-2026-76964 record; CVE-2026-89126 record; CVE-2026-89103 record; CVE-2026-120017 record.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Fireworks AI Breach: A Hacked Cloud Provider Let Attackers Reach Customer Billing Data, Datasets and Model Weights, and What to Do Now
Fireworks AI says attackers used a hacked third-party cloud provider to reach its development machines and cus...
iPhone Exploit Kits: Leaked DarkSword Code Reached an Employee's iPhone Through an Instagram Ad, and How to Lock Down Work Phones
Criminals are now using leaked iPhone exploit kits built for spies to break into out-of-date iPhones through a...
iOS App Sandbox Bypass: Public worse_query Code Reaches Other Apps' Data on iOS 26 and 27.2, No Apple Fix Confirmed, and What to Do This Week
A developer has published worse_query, proof-of-concept code that lets an iPhone app reach other apps' data on...
