SAP Patch Day November 2026: Four CVSS 10.0 Flaws in NetWeaver, Web Dispatcher, Gateway and SAML Login, and What to Patch This Week
SAP's November 2026 Patch Day brings 35 new security notes. Four flaws score the maximum CVSS 10.0, and none needs a login to abuse. Here is what is confirmed and what to check this week.
Where Worldwide
On this page 9 sections
SAP released its November 2026 security patches on Tuesday, 10 November. Four of the flaws carry the highest possible severity score, CVSS 10.0. If your company runs SAP for finance, orders, payroll or the supply chain, these bugs are in core parts of the platform: the ABAP application server, SAP Web Dispatcher, SAP Gateway and SAML single sign-on. SAP's own descriptions say an attacker with no login could abuse each one over the network.
This post covers what SAP confirmed, what is still unknown, and what your SAP team should check this week.
What SAP released on November 2026 Patch Day
SAP's Security Patch Day page for November 2026 lists:
- 35 new security notes
- 3 updates to notes released earlier
- 4 security advisories published on GitHub for SAP open-source projects, separate from the notes
Nine of the new notes are rated Critical (CVSS 9.0 or higher) and 13 are rated High. The rest are Medium or Low.
All four CVSS 10.0 flaws have the same score vector in their CVE records: the attack comes over the network, it is not complicated, it needs no account and no user action, and it has a high impact on confidentiality, integrity and availability. The damage can also reach beyond the vulnerable component.
The four CVSS 10.0 SAP vulnerabilities
| CVE | SAP note | Component | What SAP says the flaw does | Affected releases listed by SAP |
|---|---|---|---|---|
| CVE-2026-76964 | 3778530 | NetWeaver AS ABAP, Internet Communication Manager (ICM) | Specially crafted network traffic can corrupt memory, which could allow code execution and full system compromise | KRNL64UC 7.53; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 |
| CVE-2026-89126 | 3778556 | SAP Web Dispatcher | Specially crafted network traffic can cause a heap buffer overflow, which could allow code execution | WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, plus kernel, HANA (HDB 2.00) and XS Advanced components; check the note for your release |
| CVE-2026-89103 | 3798345 | SAP Gateway | A default access control list with high privileges can let an outside attacker be treated as an internal application server | KRNL64NUC 7.22 and 7.22EXT; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21; check the note for KRNL64UC |
| CVE-2026-120017 | 3849308 | SAML2 Service Provider in AS ABAP and ABAP Platform | In certain configurations, incoming login assertions are not checked properly, so an attacker could pretend to be any user, including administrators | SAP_BASIS 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 920, 921, 922 |
The CVE records add some detail. The SAML flaw could lead to "full system compromise" and could affect connected systems. The Gateway flaw is classed as incorrect authorization.
The other Critical SAP notes this month
Five more notes are rated Critical, just below 10.0:
- Knowledge Management (XML Forms): code injection, CVSS 9.9
- ABAP Application Server: operating system command injection, CVSS 9.9
- S4CRM: missing authorization check, CVSS 9.9
- Web Dispatcher and ICM: cross-site request forgery, CVSS 9.6
- BusinessObjects BI Platform (Web Intelligence): XML external entity flaw, CVSS 9.1
SAP also rated several High memory corruption and denial of service bugs in Web Dispatcher, ICM, the Message Server and the Internet Graphics Service. Most companies will get those fixes in the same kernel update.
What is confirmed and what is not
Confirmed by SAP: the patches, the note numbers, the severity scores, the affected releases, and the short descriptions above. All four 10.0 flaws are described as exploitable by an unauthenticated attacker over the network.
Not known:
- SAP's patch day page does not say that any of these flaws is being exploited, and we found no confirmation that they are.
- SAP has published no technical details beyond the short descriptions.
- The exact fixed kernel patch levels, workarounds and the specific SAML configurations at risk are in the SAP notes themselves. Those notes need an SAP support login, so we have not seen them and do not list patch levels here.
If you read a report that claims attacks are under way or gives fixed patch levels, check it against the notes before you act on it.
How to check if your SAP system is affected
Your SAP Basis team or SAP partner can answer these questions quickly:
- Which kernel release and patch level are we on? In SAP GUI, System > Status shows the kernel release and patch number. Compare them with notes 3778530, 3798345 and 3792735.
- Do we run a standalone Web Dispatcher? Many companies run it as a separate install in front of SAP, and it has its own version. Compare it with note 3778556.
- Which SAP_BASIS release are we on, and is SAML single sign-on turned on? The SAML2 transaction shows whether the system acts as a SAML service provider. Compare the release with note 3849308.
- What can reach SAP from outside? List every SAP host and port that is reachable from the internet, a partner network or a VPN.
What to do this week
| Task | Who | Why |
|---|---|---|
| Read notes 3778530, 3778556, 3798345 and 3849308 in SAP for Me | Basis team or SAP partner | These are the four CVSS 10.0 fixes |
| Update the kernel and any standalone Web Dispatcher to the patch level named in the notes | Basis team | Three of the four 10.0 flaws are in kernel or Web Dispatcher releases |
| Apply the SAML2 correction or support package from note 3849308 | Basis team | Stops attackers pretending to be any user, including administrators |
| Review the SAP Gateway access control lists (secinfo and reginfo) while you patch | Basis team | The Gateway flaw involves a permissive default access list |
| Block internet access to SAP ports that do not need to be public | Network or firewall owner | Cuts down who can reach the vulnerable services |
| Schedule the remaining Critical and High notes, starting with S4CRM, Knowledge Management and BusinessObjects if you use them | IT lead | Five more Critical notes and 13 High notes arrived this month |
| Write down the kernel patch level and date after patching | IT lead | Gives you proof for auditors and insurers |
Kernel updates normally need a restart, so plan a maintenance window. Test first if you can, but do not let testing push a CVSS 10.0 fix back by weeks.
Why this matters for a company network
SAP usually holds a company's most sensitive records: payments, supplier bank details, customer orders, payroll and HR files. A login bypass that lets someone act as an administrator could be used to change payment details or export data, and it would look like normal activity from a trusted account.
Web Dispatcher and ICM are the parts of SAP that handle web traffic. Web Dispatcher in particular is built to sit in front of SAP systems and pass requests through to them. If either one can be reached from the internet, the risk from these memory corruption flaws is far higher than if SAP is only reachable inside your network.
SAP systems also tend to be patched slowly, because they are business-critical and restarts are disruptive. That delay is the gap attackers count on. One question to ask this week: does anyone own SAP patching on a schedule, or does it only happen when someone remembers?
SAP patch questions people are asking
When was SAP Patch Day November 2026?
Tuesday, 10 November 2026. SAP releases security notes on the second Tuesday of each month.
How many SAP security notes were released in November 2026?
35 new notes and 3 updated notes. SAP also published 4 GitHub security advisories for its open-source projects.
Which SAP vulnerabilities are rated CVSS 10.0?
CVE-2026-76964 (ICM in NetWeaver AS ABAP), CVE-2026-89126 (Web Dispatcher), CVE-2026-89103 (SAP Gateway) and CVE-2026-120017 (SAML2 service provider in AS ABAP and ABAP Platform).
Are the SAP November 2026 flaws being exploited?
SAP's patch day page does not say so, and we found no confirmation of attacks. That can change quickly once patches are out, so patch now anyway.
Do I need a new SAP kernel?
Most likely, yes. The ICM, Web Dispatcher and Gateway flaws affect kernel and Web Dispatcher releases. The note for each one names the patch level that fixes it.
Is the SAP Web Dispatcher vulnerability fixed separately?
If you run Web Dispatcher as its own install, it needs its own update. SAP lists WEBDISP releases 7.53, 7.54, 7.77, 7.93 and 9.16 as affected.
Can I see the SAP notes without a login?
No. The full notes, including fixed patch levels and workarounds, need an SAP support account. The public patch day page lists only the titles, scores and affected releases.
The bigger lesson
The software that runs your business is only as safe as the last time someone patched it. A CVSS 10.0 flaw in a system that holds your money and your customers' data needs an owner, a schedule and a record that the fix went in, not a ticket that waits for the next quarter.
If you want a second pair of eyes on how your servers are patched and exposed, see security hardening or ask us for a quote.
Get security alerts like this by email, along with the free checklist, at /security-alerts.
Sources: SAP Security Patch Day, November 2026; CVE-2026-120017 record; CVE-2026-89103 record; CVE-2026-76964 record; CVE-2026-89126 record.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Fireworks AI Breach: A Hacked Cloud Provider Let Attackers Reach Customer Billing Data, Datasets and Model Weights, and What to Do Now
Fireworks AI says attackers used a hacked third-party cloud provider to reach its development machines and cus...
iPhone Exploit Kits: Leaked DarkSword Code Reached an Employee's iPhone Through an Instagram Ad, and How to Lock Down Work Phones
Criminals are now using leaked iPhone exploit kits built for spies to break into out-of-date iPhones through a...
iOS App Sandbox Bypass: Public worse_query Code Reaches Other Apps' Data on iOS 26 and 27.2, No Apple Fix Confirmed, and What to Do This Week
A developer has published worse_query, proof-of-concept code that lets an iPhone app reach other apps' data on...
