Summary
- SAP's November Patch Day includes 35 new security notes, four GitHub advisories and three updates to earlier notes.
- Four vulnerabilities carry CVSS scores of 10.0, covering memory corruption, access-control and authentication weaknesses.
- Affected components include SAP NetWeaver, Web Dispatcher and Gateway infrastructure widely used to support enterprise applications.
SAP has released security fixes for four maximum-severity vulnerabilities affecting enterprise application infrastructure, including weaknesses that could allow unauthorised access or code execution in systems supporting critical business operations.
The German software company SAP published 35 new security notes and four GitHub security advisories on 10 November, alongside three updates to previously issued notes. Its monthly bulletin covers vulnerabilities across NetWeaver, Web Dispatcher, SAP Gateway and other enterprise components.
Four of the vulnerabilities have been assigned CVSS scores of 10.0, the maximum possible rating under the commonly used CVSS v3.1 scoring framework. The severity reflects the potential consequences under the documented attack conditions, rather than confirmation that the vulnerabilities are being actively exploited.
The highest-rated issues involve different mechanisms, including memory corruption, insufficient access controls and missing authentication. Because those mechanisms affect different parts of SAP’s software architecture, organisations must determine which products and components are present in their particular installations.
Critical flaws affect application infrastructure
CVE-2026-76964 is a memory corruption vulnerability affecting the Internet Communication Manager component of SAP NetWeaver Application Server ABAP. The component handles internet communication for SAP applications and forms part of the infrastructure through which web requests reach business systems.
A separate memory corruption vulnerability, CVE-2026-89126, affects SAP Web Dispatcher. This component routes incoming web requests to SAP application servers and is frequently deployed at the boundary between users, connected systems and enterprise applications.
Both vulnerabilities carry CVSS scores of 10.0. Their presence in components involved in processing network traffic makes exposure particularly dependent on the installed versions, accessibility of the affected services and the network architecture surrounding them.
SAP Gateway is affected by CVE-2026-89103, a broken access-control vulnerability also rated 10.0. Gateway services enable communication between SAP applications and other systems, creating interfaces that can hold extensive permissions within integrated enterprise environments.
The fourth maximum-severity issue, CVE-2026-120017, concerns missing authentication in the SAML2 Service Provider functionality of SAP NetWeaver Application Server ABAP and the ABAP Platform.
SAML-based authentication allows applications to rely on a separate identity provider for user sign-in. A failure to enforce authentication correctly can undermine the trust relationship between the application and its identity infrastructure.
The bulletin identifies multiple affected SAP_BASIS versions, so the remediation requirement is not confined to one recently released product build.
Further critical weaknesses expand patching demands
Alongside the four 10.0-rated vulnerabilities, SAP published several additional critical notes. These include a 9.9-rated code injection issue affecting NetWeaver Knowledge Management XML Forms and a similarly rated operating-system command injection vulnerability in the ABAP application server.
Another critical finding concerns a missing authorisation check in S4CRM. Additional vulnerabilities affect Web Dispatcher and Internet Communication Manager, while BusinessObjects Business Intelligence Platform Web Intelligence has received a correction for an XML external entity weakness.
The breadth of the update creates a substantial assessment exercise for organisations operating complex SAP environments. Different business units may use separate application versions, while older systems can remain connected to newer integration and identity services.
In large enterprises, SAP infrastructure frequently underpins finance, procurement, manufacturing, workforce administration and other operational processes. A vulnerability affecting shared application services can therefore create consequences beyond one business application.
Attackers gaining privileged access to an application server or integration component may potentially reach information and functions used by several connected systems. The actual extent depends on authorisation, segmentation and the permissions granted to the compromised component.
That dependency is particularly relevant where internet-facing services connect to internal SAP environments. Restricting access to management or application interfaces can reduce exposure, but network controls do not eliminate the need to correct vulnerable software.
SAP publishes affected product versions and remediation notes separately, requiring customers to assess the applicability of each correction. This is not a uniform update that can be assumed to apply identically across all installations.
The company also recommends secure configuration alongside the installation of patches. System owners must account for dependencies between application servers, integration interfaces and authentication components when validating updates against production workloads.
November’s release follows an extensive October patch cycle, continuing a period of substantial vulnerability remediation across the company’s enterprise software portfolio.
Although the maximum CVSS scores make several corrections high priorities, SAP’s public bulletin does not establish that all affected environments are internet-accessible or that the newly disclosed vulnerabilities have been exploited. The company has published the individual notes and affected-version information through its security support portal.
