SAP Security Patch Day November 2026: Four CVSS 10.0 NetWeaver

On 10 November 2026, SAP's Security Patch Day released 35 new security notes and 4 GitHub security advisories, with 3 updates to previously released notes. SAP strongly recommends that customers visit the support portal and apply patches on priority. Four new notes in the core NetWeaver stack carry an SAP CVSS 3.1 score of 10.0, Critical: CVE-2026-120017 in the AS ABAP SAML2 service provider, CVE-2026-76964 in the Internet Communication Manager, CVE-2026-89103 in SAP Gateway, and CVE-2026-89126 in SAP Web Dispatcher.

Each of those four records is scored CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H . The vectors are SAP-assigned. NVD lists the records in Received status and mirrors the SAP 10.0 metrics; those NVD entries are not independently assigned NVD scores. All four official descriptions state that the attacker can be unauthenticated. They are distinct flaws, not evidence of a demonstrated exploit chain.

Organizations running SAP ERP or S/4HANA, especially where Web Dispatcher, ICM or Gateway is internet-facing or where SAML2 single sign-on is enabled on ABAP, should treat the four 10.0 notes as the first patch priority.

Technical Information

CVE-2026-120017: SAML2 service-provider assertion validation

SAP titles this issue missing authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider), Security Note 3849308. The weakness is CWE-347, improper verification of a cryptographic signature. SAP states that the platform "does not perform sufficient verification of incoming authentication assertions under certain configurations." An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with impact potentially extending to connected components.

The qualifier "under certain configurations" is part of the official record, not a public exception list. Systems that use SAML2 on an affected SAP_BASIS release should be validated against Note 3849308 rather than assumed safe. Tenable republishes the same SAP description and 10.0 vector.

CVE-2026-76964: Internet Communication Manager memory corruption

Note 3778530 addresses a memory-corruption vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager), CWE-1287. SAP states that the application server "does not sufficiently validate certain network input processed by an internal component." An unauthenticated attacker could send specially crafted network traffic to trigger a memory-corruption condition. Successful exploitation, SAP writes, could allow the attacker to execute arbitrary code and fully compromise the system. That code-execution outcome is in the SAP-authored CVE record, not a press inference.

CVE-2026-89103: SAP Gateway broken access control

Note 3798345 addresses broken access control in SAP Gateway, CWE-863. SAP's public description is specific the starting condition: "SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server." An unauthenticated attacker with network access to the Gateway could exploit this weakness to potentially perform unauthorized actions, with high impact on confidentiality, integrity and availability. The default-ACL wording is SAP's. Read Note 3798345 for configuration guidance rather than assuming a changed ACL is out of scope, or that only a default install is affected.

CVE-2026-89126: Web Dispatcher memory corruption

Note 3778556 addresses a memory-corruption vulnerability in SAP Web Dispatcher, classified as CWE-122, heap-based buffer overflow. The public description parallels the ICM issue: an unauthenticated attacker could send specially crafted network traffic to trigger a memory-corruption condition. Successful exploitation, SAP writes, could allow arbitrary code execution and full compromise of the system. Where Web Dispatcher is the internet-facing front end, this note is a priority, but that role does not by itself prove a given host is reachable.

Other Critical notes in the same release

The official Patch Day page marks nine new notes Critical. Besides the four 10.0 issues, five further notes SAP rates Critical have different privilege or interaction requirements and should not be folded into the unauthenticated 10.0 set. They are CVE-2026-109803 (Note 3809153, SAP CVSS 3.1 9.9, PR:L ), code injection in NetWeaver Knowledge Management XML Forms; CVE-2026-76965 (Note 3792735, 9.9, PR:L ), OS command injection in the ABAP application server; CVE-2026-109795 (Note 3834842, 9.9, PR:L ), a missing authorization check and CWE-94 weakness in S4CRM, S4CEXT and BBPCRM; CVE-2026-89119 (Note 3804858, 9.6, PR:N , UI:R ), CSRF in Web Dispatcher and ICM in which an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link (SAP says successful exploitation could compromise the operating system; the same note also lists CVE-2026-120014); and CVE-2026-109798 (Note 3799117, 9.1, PR:L ), an XML external entity issue in BusinessObjects Web Intelligence. The Critical rating must not be applied indiscriminately to every note in the release.

Affected Product Versions

Product and version lines follow SAP's public 10 November 2026 Patch Day page, which this advisory uses as the official public list. The SAP-authored CVE records agree on the product families and scores; for Gateway and Web Dispatcher the Patch Day page lists some kernel lines more fully.

The detailed Security Notes typically require a SAP Support Portal login. Confirm each system's exact release, kernel and SAP_BASIS combination against the applicable note. This advisory does not invent configuration exceptions or managed-service exposure from the public summaries.

The reviewed SAP Patch Day page and the SAP-authored CVE records do not report exploitation of these vulnerabilities. CVE-2026-120017, CVE-2026-76964, CVE-2026-89103, CVE-2026-89126 and the five other Critical identifiers listed above are not in CISA's Known Exploited Vulnerabilities catalog (catalogVersion 2026.11.09, checked 10 November 2026 at 10:29 Asia/Jerusalem UTC+2). This is a point-in-time finding, not evidence that exploitation is impossible or that no private attacks have occurred.

The CVSS 10.0 impact and unauthenticated access described in the four core notes justify prompt patching without inventing a campaign, a threat actor or a public exploit.

Workaround and Mitigation

SAP's public Patch Day page does not list workarounds for these notes. It recommends applying the patches on priority through the support portal. Any note-specific interim step, if one exists, will be in the login-walled Security Note, not in this summary.

As operational preparation, not as an SAP-provided fix, inventory customer-operated SAP ERP and S/4HANA systems and record their SAP_BASIS, kernel, Web Dispatcher and Gateway versions, including internet-facing listeners and ABAP systems that use SAML2 single sign-on. Until the notes are applied, restricting unnecessary access to those services can reduce exposure, and a SAML2 configuration review is a reasonable response to CVE-2026-120017's "under certain configurations" language. Neither step replaces the official patches. After the notes are applied, retain evidence of the installed releases and validate authentication and Gateway access-control settings through authorized administrative checks.

Indicators of Compromise

No CVE-specific domains, IP addresses, file hashes or definitive detection signatures were established in the reviewed primary sources. It would be misleading to invent an indicator set or reuse indicators from earlier NetWeaver incidents. Authentication, Gateway, Web Dispatcher and ICM logs may support an investigation, but anomalies are leads rather than confirmed signatures.

What to Ask Your Suppliers Today

Ask vendors who operate SAP ERP or S/4HANA, especially those with internet-facing Web Dispatcher, ICM or Gateway or with SAML2 single sign-on on ABAP, whether they are exposed to Notes 3849308, 3778530, 3798345 and 3778556. Request a named owner, a patch ETA for each of the four 10.0 notes, and post-update version evidence rather than a generic assurance that SAP systems are maintained. Until the notes are installed, ask whether they have restricted unnecessary access to Gateway, Web Dispatcher and ICM ports and reviewed SAML2 configuration against Note 3849308. Where BusinessObjects, Knowledge Management XML Forms or S4CRM is in the same landscape, treat the additional Critical notes as a second wave, not a substitute. For a managed SAP service, request a service-specific applicability statement. Track incomplete answers to closure.

Need help working through SAP ERP and S/4HANA suppliers exposed to the November 2026 CVSS 10.0 NetWeaver notes? Our team can help you prioritize them. Talk to an expert

SAP Security Patch Day — November 2026 — official 10 November 2026 release; 35 new security notes, 4 GitHub security advisories and 3 updates; version lists and priorities used above.

SAP-authored CVE-2026-120017 record — CVSS 3.1 10.0; CWE-347; Note 3849308.

SAP-authored CVE-2026-76964 record — CVSS 3.1 10.0; CWE-1287; Note 3778530.

SAP-authored CVE-2026-89103 record — CVSS 3.1 10.0; CWE-863; Note 3798345.

SAP-authored CVE-2026-89126 record — CVSS 3.1 10.0; CWE-122; Note 3778556.

SAP-authored records for the other highlighted notes: CVE-2026-109803 (9.9, Note 3809153), CVE-2026-76965 (9.9, Note 3792735), CVE-2026-109795 (9.9, Note 3834842), CVE-2026-89119 (9.6, Note 3804858, additional CVE-2026-120014) and CVE-2026-109798 (9.1, Note 3799117).

NVD CVE-2026-120017 — Received; mirrors SAP 10.0. Companion NVD records for the other highlighted CVEs are in the same Received state and mirror the SAP metrics.

Tenable CVE-2026-120017 — republishes the SAP description and 10.0 vector.

CISA vulnerability catalog JSON feed — catalogVersion 2026.11.09, checked 10 November 2026 at 10:29 Asia/Jerusalem UTC+2.