Navigating November’s Historic SAP Security Patch Day – LIVE WEBINAR Join Onapsis to talk through November’s Vulnerabilities. November 12th, 10am ET Register here
Note: This blog contains ongoing coverage. Updates will be posted continuously below as confirmed information becomes available.
More information on the ICM2SHELL vulnerability can be found here
More information on the PROXYGATE vulnerability can be found here
Highlights of November SAP Security Notes analysis include:
November Summary – 43 new and updated SAP security patches released, including 12 HotNews Notes and 13 High Priority Notes
Four CVSS 10.0 – Memory corruptions in ICM and SAP Web Dispatcher, Missing Authentication in SAP NW AS ABAP and ABAP Platform and Broken Access Control in SAP Gateway
Onapsis Research Labs Contribution – Our team supported SAP in patching 36 vulnerabilities, covered by 24 SAP Security Notes, including 7 tagged as HotNews and 10 tagged as High Priority. 14 of the 36 Vulnerabilities, leading to 7 Security Notes were found in collaboration with XBOW.
SAP has published the record-breaking number of 43 new and updated SAP Security Notes in its November Patch Day, including 12 HotNews Notes and 13 High Priority Notes. 24 SAP Security Notes were published in collaboration with the Onapsis Research Labs.
The HotNews Notes in Detail
The Onapsis Research Labs (ORL) supported SAP in patching six of twelve HotNews Notes.
SAP Security Note #3798345 ,
SAP Security Note #3778530 ,
SAP Security Note #3778556 ,
SAP Security Note #3849308 ,
The ORL team supported SAP in patching a Missing Authorization Check vulnerability in S4CRM. Certain remote-enabled function modules do not perform necessary authorization checks and lack sufficient input validation. As a result, an attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker’s reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability. SAP Security Note #3834842 ,
Another HotNews Note that SAP has published in collaboration with our ORL team is SAP Security Note #3792735 ,
The ORL team, in collaboration with XBOW, also supported SAP in patching a CVSS 9.9 Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms). Under certain conditions, an authenticated user with access to the vulnerable functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. The vulnerability is patched with SAP Security Note #3809153 by restricting request-selected XSL transformations to only those explicitly configured for the current XML Forms project. Any unconfigured or unresolved transformation identifiers are now rejected.
SAP Security Note #3805589 ,
Two HotNews Notes affect SAP Business AI Platform and were published by SAP between October and November patch day:
SAP Security Note #3843368 ,
SAP Security Note #3804858 ,
SAP Security Note #3799117 ,
The High Priority Notes in Detail
The Onapsis Research Labs (ORL) supported SAP in patching ten of thirteen High Priority Notes.
* SAP Security Note 3810485 was identified in collaboration with XBOW. Another High Priority vulnerability that was patched in collaboration with SAP is tracked under CVE-2026-120014 and is included in HotNews Note #3804858 .
Further High Priority Notes
SAP Security Note #3769130 ,
SAP Security Note #3808552 ,
SAP Security Note #3833364 ,
The Onapsis Research Labs (ORL) contributed significantly to SAP’s November Patch Day. In addition to six HotNews Notes and ten High Priority Note, the ORL supported SAP in patching eight additional SAP Security Notes:
* SAP Security Notes 3839977,3797108,3835738, 3792447 and 3801587 were identified in collaboration with XBOW.
Summary & Conclusions
SAP’s November Patch Day has broken several records. With forty-three new and updated SAP Security Notes, including twelve HotNews and thirteen High Priority Notes, SAP administrators will be very busy this week. It was also a record-holding patch day for the Onapsis Research Labs. We could support SAP in patching thirty-six vulnerabilities, covered by twenty-four SAP Security Notes, including seven tagged as HotNews and ten tagged as High Priority Notes.
As always, the Onapsis Research Labs is already updating The Onapsis Platform to incorporate the newly published vulnerabilities into the product so that our customers can protect their businesses.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
