SAP released 35 new security notes and four GitHub security advisories on November 10, 2026, alongside three updates to earlier notes.
Four vulnerabilities carry the maximum CVSS score of 10.0 and affect NetWeaver Internet Communication Manager, Web Dispatcher, SAP Gateway, and the SAML2 Service Provider. The release covers memory corruption, missing authentication, access control failures, injection attacks, and information leaks across enterprise products.
SAP urges customers to review its security notes portal and apply corrections promptly. The release follows October’s enterprise security updates , but this month’s highest scores highlight several weaknesses reachable without authentication. SAP publishes security corrections on the second Tuesday of each month and recommends treating their implementation as a priority.
SAP November 2026 Patch Day
CVE-2026-76964 addresses memory corruption issues in the Internet Communication Manager of NetWeaver AS ABAP. CVE-2026-89126 resolves memory corruption vulnerabilities in the Web Dispatcher, including affected kernel, HANA, and extended application services components.
CVE-2026-89103 pertains to inadequate access control in SAP Gateway. At the same time, CVE-2026-120017 involves missing authentication in the SAML2 Service Provider used by NetWeaver AS ABAP and the ABAP Platform.
All four vulnerabilities the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network attacks with low complexity, no required privileges, and no user interaction. Successful exploitation of these vulnerabilities can significantly compromise confidentiality, integrity, and availability, extending beyond the security scope of the vulnerable components. The bulletin does not provide exploit payloads or detailed attack sequences.
Three additional critical notes score 9.9: code injection in Knowledge Management XML Forms, operating system command injection in the ABAP Application Server, and a missing authorization check in S4CRM. Each requires low privileges but no user interaction. Earlier NetWeaver access control reporting also highlights why administrators must check authorization requirements when deploying corrections.
A Web Dispatcher and Internet Communication Manager CSRF note covers CVE-2026-89119 and CVE-2026-120014, rated 9.6. Its vector requires user interaction but no attacker privileges. CVE-2026-109798, rated 9.1, fixes an XML external entity vulnerability in BusinessObjects Web Intelligence and affects ENTERPRISE 430, 2025, and 2027.
High-severity fixes address service disruption, memory corruption, missing authentication, and information disclosure across Message Server, Internet Graphics Service, and ABAP components. These are separate findings, not evidence that every memory corruption flaw enables code execution. NetWeaver memory corruption coverage illustrates the importance of distinguishing availability impact from broader compromise.
Developer libraries also need attention. CVE-2026-109799 concerns improper JWT signature verification in IASContextProvider, enabling tenant or user identity spoofing in Python SDK versions before 0.63.1. Its GitHub advisory accompanies separate fixes for Python agent-memory path traversal, JavaScript AI SDK information disclosure, and cross-tenant sandbox takeover in SAP/astonish.
Administrators should match installed component versions against every applicable note, starting with the four maximum-severity issues and remaining critical findings. SAP also revised earlier WebClient UI and GUI for HTML notes, so previously patched systems still require review. The supplied bulletin does not state that these vulnerabilities are being actively exploited.
The release extends concerns seen in September’s SAP security update . Teams should use individual notes for correction instructions rather than treating affected-version lists as installation guidance. The table below preserves all listed CVEs, affected releases, priorities, and published scores, including notes covering multiple identifiers and the update without an assigned CVE.
Complete CVE and Affected-Version
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs .
Artificial Intelligence
Cyber security Course
Cyber Security Resources
Cybersecurity
Information Gathering
Information Security Risks
Critical Apache Airflow Flaw CVE-2026-68982 Enables Unauthenticated Remote Code Execution
Russian-Linked Turla Hackers Abuse Microsoft Exchange Infrastructure to Target Sensitive Communications
SEGA Confirms Data Breach Exposing 2.19 Million Customer Email Addresses Following Third-Party Cyberattack
North Korean Hackers Target Drone Technology and Software Supply Chains in New Cyberespionage Campaigns
Fireworks AI Hit by LLMJacking Cyberattack Exposing Customer Data and AI Model Weights
Dark Storm Team Offers DDoS Attacks, Database Dumps, and Stolen Access Through Telegram Channels
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
