SAP's November patch day brings four flaws scored a perfect 10

SAP's November patch day brings four flaws scored a perfect 10

10 November 2026: SAP has released fixes for four vulnerabilities rated CVSS 10.0, CVE-2026-76964, CVE-2026-89126, CVE-2026-89103 and CVE-2026-120017, across the NetWeaver kernel, Web Dispatcher, Gateway and the SAML2 login service. The batch holds 35 new security notes and 4 GitHub advisories, plus 3 updates to older notes, and SAP asks customers to apply them as a priority.

Not yet independently verified. SAP's public page lists affected versions and scores but no attack conditions, and it makes no statement on exploitation. The fixed patch levels sit in the individual notes, which require a customer login and which we have not read. We will update this when it can be confirmed, and remove this note.

The four notes scored 10.0

• 3778530, CVE-2026-76964: memory corruption in the Internet Communication Manager of NetWeaver AS ABAP. Kernel 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20.
• 3778556, CVE-2026-89126: memory corruption in SAP Web Dispatcher, including WEBDISP 7.53 to 9.16, HDB 2.00 and XS Advanced Runtime 1.00.
• 3798345, CVE-2026-89103: broken access control in SAP Gateway, across kernel 7.22 to 9.21.
• 3849308, CVE-2026-120017: missing authentication in the SAML2 Service Provider of NetWeaver AS ABAP and ABAP Platform, from SAP_BASIS 702 upward.

Why the edge components come first

Web Dispatcher and the Internet Communication Manager are the parts of an SAP estate that take HTTP traffic, often directly from outside the company, and Gateway is the way into the system for other applications. An installation where those are exposed should start there, then move on to the SAML2 note, because a missing authentication flaw in a single sign-on path goes to the heart of who the system believes a user is.

Kernel-level notes usually mean a restart of the application server, so they need a maintenance window. That is the point to plan today, ahead of reading each note for its exact patch level.

Five more critical notes behind the top four

Scored 9.9 are note 3809153, a code injection in NetWeaver Knowledge Management XML Forms (CVE-2026-109803, KMC-CM 7.50); note 3792735, an OS command injection in the ABAP Application Server (CVE-2026-76965); and note 3834842, a missing authorization check in S4CRM (CVE-2026-109795, S4CRM 204 to 206, S4CEXT 107 to 109, BBPCRM 713 and 714).

Note 3804858 covers a cross-site request forgery in Web Dispatcher and the Internet Communication Manager at 9.6 (CVE-2026-89119, with CVE-2026-120014). Note 3799117 is an XML external entity flaw at 9.1 in BusinessObjects Web Intelligence (CVE-2026-109798, Enterprise 430, 2025 and 2027).

The rest of the list

Across all 42 rows on the page, SAP rates 9 critical, 17 high, 15 medium and 1 low. Among the GitHub advisories, SAP Cloud SDK for Python carries a high-rated flaw in JSON Web Token signature checks (CVE-2026-109799) in its IASContextProvider. The three updated notes date from the October and July patch days of this year and from April 2022, all rated medium, and a team that closed those earlier should check whether the revised text asks for anything further.

Our ERP software category lists two products.

Related on TrustList:

• SAP patches a CVSS 10 token flaw in its Cloud SDK for Python
• Cognizant agrees to buy DyFlex, an Australian SAP partner of 300 staff

Sources

• SAP Security Patch Day, November 2026, 10 November 2026