November 2026 security updates

support.sap.com • November 10, 2026

This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape. On 10 th of November 2026, SAP security patch day saw the release of 35 new security notes and 4 GitHub security advisories. There are 3 updates to previously released security notes.

[ CVE-2026-76964 ] Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)

Product - SAP NetWeaver AS ABAP (Internet Communication Manager) Version(s) - KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20

[ CVE-2026-89126 ] Memory Corruption vulnerability in SAP Web Dispatcher

Product - SAP Web Dispatcher Version(s) - HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20

[ CVE-2026-89103 ] Broken Access Control in SAP Gateway

Product - SAP Gateway Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21

[ CVE-2026-120017 ] Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)

Product - SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) Version(s) - SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 920, SAP_BASIS 921, SAP_BASIS 922

[ CVE-2026-109803 ] Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms)

Product - SAP NetWeaver Knowledge Management (XML Forms) Version(s) - KMC-CM 7.50

[ CVE-2026-76965 ] OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform

Product - SAP NetWeaver and ABAP Platform Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16

[ CVE-2026-109795 ] Missing authorization check in S4CRM

Product - S4CRM Version(s) - S4CRM 204, 205, 206, S4CEXT 107, 108, 109, BBPCRM 713, 714

[ CVE-2026-89119 ] Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager

Additional CVE: CVE-2026-120014

Product - SAP Web Dispatcher and Internet Communication Manager Version(s) - WEBDISP 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, KERNEL 7.93, 9.16, 9.20, 9.21

[ CVE-2026-109798 ] XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

Product - SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Version(s) - ENTERPRISE 430, 2025, 2027

[ CVE-2026-76966 ] Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform

Additional CVE: CVE-2026-109796

Product - SAP NetWeaver and ABAP Platform Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20

[ CVE-2026-120008 ] Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service)

Product - SAP NetWeaver (Internet Graphics Service) Version(s) - BC-FES-IGS 7.20EXT, 7.20_EX2, 7.53, 7.54, 7.81, 9.16

[ CVE-2026-109800 ] Memory Corruption vulnerability in SAP Web Dispatcher

Product - SAP Web Dispatcher Version(s) - KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.20, 9.21

[ CVE-2026-109799 ] Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip))

Library - SAP Cloud SDK for Python Version(s) < 0.63.1

[ CVE-2026-109793 ] Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher

Product - SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher Version(s) - WEBDISP 9.16, KERNEL 9.16, 9.20, 9.21

[ CVE-2026-120010 ] Memory Corruption vulnerability in SAP NetWeaver Application Server (SAP Message Server)

Product - SAP NetWeaver Application Server (SAP Message Server) Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20, 9.21

[ Multiple CVEs ] Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service) CVEs: CVE-2026-109806 , CVE-2026-109807

Product - SAP NetWeaver (Internet Graphics Service) Version(s) - BC-FES-IGS 7.20EXT, 7.20_EXT2, 7.53, 7.54, 7.81, 9.16

[ CVE-2026-76970 ] Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform

Product - SAP NetWeaver and ABAP Platform Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.22EX2, 7.22EX3, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20, 9.21, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20, 9.21

[ CVE-2026-109804 ] Information Disclosure in SAP NetWeaver (SAP Message Server)

Product - SAP NetWeaver (SAP Message Server) Version(s) - KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.20, 9.21

[ CVE-2026-89114 ] Missing Authentication check in SAP NetWeaver AS Java EDM Application

Product - SAP NetWeaver AS Java EDM Application Version(s) - CE-RA-EDM 7.50

[ CVE-2026-76973 ] Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server)

Product - SAP NetWeaver and ABAP Platform (SAP Message Server) Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20, 9.21

[ CVE-2026-109794 ] Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher

Product - SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher Version(s) - WEBDISP 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.0, KERNEL 7.77, 7.93, 9.16

GHSA-28c8-457r-4cf6 (opens in new tab)

[ CVE-2026-120013 ] Path Traversal in Agent Memory Module of SAP Cloud SDK for Python

Library - SAP Cloud SDK for Python Version(s) < 0.50.0

[ CVE-2026-120012 ] Information Disclosure vulnerability in SAP Cloud SDK for AI(JavaScript)

Library - SAP Cloud SDK for AI(JavaScript) Version(s) <= v2.17.0

[ CVE-2026-120015 ] Insufficient Input Validation in SAP Host Agent

Product - SAP Host Agent Version(s) - SAPHOSTAGENT 7.22

[ CVE-2026-120009 ] Code Injection vulnerability in SAP ABAP Developer Tools (AMDP Data Preview)

Product - SAP ABAP Developer Tools (AMDP Data Preview) Version(s) - SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 920

[ CVE-2026-109797 ] Cross-tenant sandbox takeover in SAP/astonish

Product - SAP/astonish Version(s) < v3.6.0

[ CVE-2026-109802 ] Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server for ABAP

Product - SAP NetWeaver Application Server for ABAP Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20, 9.21

[ CVE-2026-109811 ] Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Product - SAP NetWeaver and ABAP Platform (Application Server ABAP) Version(s) - SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 920, SAP_BASIS 921

[ Multiple CVEs ] Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit) CVEs: CVE-2026-109801 , CVE-2026-109809

Product - SAP NetWeaver Application Server Java (NWDI Cockpit) Version(s) - DI_NTY 7.50

[ CVE-2026-109805 ] W eak Cryptography in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Product - SAP NetWeaver and ABAP Platform (Application Server ABAP) Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.20, 9.21

[ CVE-2026-120016 ] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Visual Composer

Product - SAP NetWeaver Visual Composer Version(s) - VC70RUNTIME 7.50

[ CVE-2026-109810 ] CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)

Product - SAP NetWeaver Application Server Java (Web Dynpro Java) Version(s) - WD-RUNTIME 7.50

[ CVE-2026-89125 ] Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager

Product - SAP Web Dispatcher and Internet Communication Manager Version(s) - KRNL64NUC 7.22,7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.22_EXT, 7.53, 7.54, 7.77, 7.93, 9.16, KERNEL 7.22,7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20

[ CVE-2026-89129 ] Server-Side Request Forgery in SAP NetWeaver AS Java (Web Services)

Product - SAP NetWeaver AS Java (Web Services) Version(s) – ENGINEAPI 7.50, J2EE-FRMW 7.50

Update to Security Note released on October 2026 Patch Day:

[ CVE-2026-76976 ] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

Product - SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) Version(s) - SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816

[ CVE-2026-89128 ] Broken Access Control in SAP NetWeaver Process Integration (Process Integration Test Tool)

Product - Broken Access Control in SAP NetWeaver Process Integration (Process Integration Test Tool) Version(s) - SAP_XIPIT 7.50

[ CVE-2026-73635 ] Denial of service (DoS) in SAP Business Objects

Product - SAP Business Objects Version(s) – ENTERPRISE 430, 2025, 2027, ENTERPRISECLIENTTOOLS 430, 2025, 2027

[ CVE-2026-89115 ] Information Disclosure vulnerability in SAP Start Service and SAP Microsoft Management Console

Product - SAP Start Service and SAP Microsoft Management Console Version(s) - HDB 2.00, KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, CONTSERV 7.53, 7.54, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19, 9.20, MMC 7.93

[ CVE-2026-89131 ] Cross Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Enterprise Portal

Product - SAP NetWeaver Enterprise Portal Version(s) - EP-BASIS 7.50, EP-BASIS-API 7.50, EP-RUNTIME 7.50, EP-ADMIN 7.50

Update to Security Note released on July 2026 Patch Day: [ CVE-2026-44768 ] Security misconfiguration in SAP WebClient UI

Product - SAP WebClient UI Version(s) - S4FND 104, 105, 106

Update to Security Note released on April 2022 Patch Day: Prepare CSP support for On-Premise down port for code dependency in SAP WebClient UI

Product - SAP WebClient UI Version(s) - S4FND 104

[ CVE-2026-109808 ] Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI)

Product - SAP Solution Tools Plug-In (ST-PI) Version(s) - ST-PI 2008_1_700, 2008_1_710, 740, 758

To know more the security researchers and research companies who have contributed for security patches of this month, visit here . SAP is committed to delivering trustworthy products and cloud services. Secure configuration is essential to ensuring secure operation and data integrity. We have therefore documented security recommendations that are consolidated in this document to help you configure the best security for your SAP portfolio. Archived blogs from years are available here . If you have any or feedback this post, you can write to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SAP Patches Four Critical CVSS 10.0 Vulnerabilities on November 2026 Patch Day On November 10, 2026, SAP released security updates addressing four critical vulnerabilities rated CVSS 10.0. These include ICM2SHELL (CVE-2026-76964 and CVE-2026-89126), affecting the Internet Communication Manager and Web Dispatcher, and PROXYGATE (CVE-2026-89103) in SAP Gateway. A missing authentication flaw in the SAML2 Service Provider (CVE-2026-120017) was also patched. All four vulnerabilities allow unauthenticated attackers to execute remote code or impersonate users, posing significant risks to enterprise systems. SAP recommends immediate patching due to the potential for exploitation without user interaction. The vulnerabilities affect a wide range of SAP products, including NetWeaver and S/4HANA, and could lead to full system compromise. Onapsis, which discovered three of the vulnerabilities, has not observed any in-the-wild exploitation yet. 14 sources 72

Extracted Entities

CVEs (45)

November 2026 security updates

The full story

Extracted Entities

CVEs (45)

CWE Weaknesses (9)

Domains (1)

Email Addresses (1)

Platforms (5)