SAP held its November Patch Day on Tuesday this week. It includes 35 new security notes, addressing, among other things, nine vulnerabilities classified as critical. IT administrators should check whether they use the vulnerable software and plan to install updates promptly.
The SAP Patch Day overview lists the individual security notes. Critical vulnerabilities, including four with the maximum CVSS score of 10.0, affect the following products:
SAP NetWeaver AS ABAP (Internet Communication Manager), CVE-2026-76964, CVSS 10.0 , risk “ critical ”
SAP Web Dispatcher, CVE-2026-89126, CVSS 10.0 , risk “ critical ”
SAP Gateway, CVE-2026-89103, CVSS 10.0 , risk “ critical ”
SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider), CVE-2026-120017, CVSS 10.0 , risk “ critical ”
SAP NetWeaver Knowledge Management (XML Forms), CVE-2026-109803, CVSS 9.9 , risk “ critical ”
ABAP Application Server for SAP NetWeaver and ABAP Platform, CVE-2026-76965, CVSS 9.9 , risk “ critical ”
S4CRM, CVE-2026-109795, CVSS 9.9 , risk “ critical ”
SAP Web Dispatcher and Internet Communication Manager, CVE-2026-89119, CVSS 9.6 , risk “ critical, ” and CVE-2026-120014
SAP BusinessObjects Business Intelligence Platform (Web Intelligence), CVE-2026-109798, CVSS 9.1 , risk “ critical ”
According to SAP, the security patches also affect Server ABAP of SAP NetWeaver and ABAP Platform, SAP NetWeaver (Internet Graphics Service), SAP Web Dispatcher, SAP Cloud SDK for Python, SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher, SAP NetWeaver Application Server (SAP Message Server), Application Server ABAP for SAP NetWeaver and ABAP Platform, SAP NetWeaver AS Java EDM Application, Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server), SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher, SAP Cloud SDK for AI (JavaScript), SAP Host Agent, SAP ABAP Developer Tools (AMDP Data Preview), SAP/astonish, SAP NetWeaver Application Server for ABAP, SAP NetWeaver and ABAP Platform (Application Server ABAP), SAP NetWeaver Application Server Java (NWDI Cockpit), SAP NetWeaver Visual Composer, SAP NetWeaver Application Server Java (Web Dynpro Java), SAP Web Dispatcher and Internet Communication Manager, SAP NetWeaver AS Java (Web Services), SAP NetWeaver Process Integration (Process Integration Test Tool), SAP Business Objects, SAP Start Service and SAP Microsoft Management Console, SAP NetWeaver Enterprise Portal and, finally, SAP Solution Tools Plug-In (ST-PI).
On October’s Patch Day, SAP addressed 16 new vulnerabilities as well as four GitHub security advisories. SAP developers considered four of the SAP vulnerabilities critical.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
