SAP's November Patch Tuesday release addresses four maximum-severity vulnerabilities that could allow attackers to execute malicious code, bypass authentication, or gain unauthorized access to enterprise systems.
According to SAP's Nov. 10 security bulletin, the company released 35 new security notes, four GitHub advisories, and three updates to previously issued notes.
The most serious flaws affect SAP NetWeaver, Web Dispatcher, and Gateway, components responsible for processing network traffic, authenticating users, and connecting business applications. Two could allow unauthenticated attackers to execute code remotely on vulnerable systems.
Four SAP vulnerabilities receive maximum CVSS scores
All four vulnerabilities carry a CVSS score of 10.0, the highest possible severity rating.
| CVE | Affected component | Vulnerability | CVSS |
|---|---|---|---|
| CVE-2026-76964 | SAP NetWeaver AS ABAP (Internet Communication Manager) | Memory corruption | 10.0 |
| CVE-2026-89126 | SAP Web Dispatcher | Memory corruption | 10.0 |
| CVE-2026-89103 | SAP Gateway | Broken access control | 10.0 |
| CVE-2026-120017 | SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) | Missing authentication | 10.0 |
The two memory corruption flaws, CVE-2026-76964 and CVE-2026-89126, affect how SAP components process network traffic.
According to The Hacker News' technical analysis, both involve improper handling of WebSocket control frames. An unauthenticated attacker could send specially crafted requests to trigger memory corruption and potentially execute arbitrary code.
CVE-2026-89103 targets SAP Gateway, which manages communication between SAP applications and connected systems. Under certain configurations, attackers could impersonate trusted application servers and perform unauthorized operations.
Meanwhile, CVE-2026-120017 affects the SAML 2.0 service provider used for single sign-on. Missing authentication checks could allow attackers to impersonate users, including privileged accounts, on affected systems.
The vulnerabilities are particularly concerning because they affect services that control communication and access across SAP environments.
Additional critical vulnerabilities affect SAP applications
Beyond the four maximum-severity flaws, SAP addressed five other vulnerabilities rated critical.
Three carry CVSS scores of 9.9:
- CVE-2026-109803: Code injection in SAP NetWeaver Knowledge Management's XML Forms component.
- CVE-2026-76965: Operating system command injection affecting the ABAP Application Server for SAP NetWeaver and ABAP Platform.
- CVE-2026-109795: Missing authorization checks in S4CRM components.
SAP also patched a cross-site request forgery vulnerability affecting Web Dispatcher and Internet Communication Manager, tracked as CVE-2026-89119 and rated 9.6. The corresponding security note additionally references CVE-2026-120014.
Another critical issue, CVE-2026-109798, is an XML External Entity vulnerability affecting SAP BusinessObjects Business Intelligence Platform, with a CVSS score of 9.1.
The release follows October's SAP security updates, which addressed a critical S/4HANA code injection flaw and a separate NetWeaver memory corruption vulnerability.
SAP also addressed a critical Cloud SDK vulnerability that could expose application credentials in October, highlighting security risks across both traditional SAP installations and cloud-connected applications.
What SAP administrators should patch first
SAP recommends that customers review its security notes and prioritize applying the available corrections.
Security and SAP Basis teams should focus on the following:
- Identify affected installations. Inventory NetWeaver, Web Dispatcher, Gateway, and SAML2 components, then compare deployed versions with SAP's security notes.
- Prioritize exposed services. Review network-accessible Web Dispatcher and Internet Communication Manager interfaces, particularly those reachable without authentication.
- Check authentication and access controls. Examine SAML2 configurations, trusted identity providers, and Gateway access control rules.
- Apply security updates. Coordinate kernel and application patches with SAP administrators, testing changes before production deployment.
- Verify remediation. Confirm that affected components are running corrected versions and review relevant logs for suspicious activity.
The four maximum-severity vulnerabilities correspond to SAP Security Notes 3778530, 3778556, 3798345, and 3849308, respectively.
Where immediate patching is not possible, administrators should follow SAP's documented mitigation guidance. Network restrictions may help reduce exposure, but they do not replace the required security updates. Some affected components have no documented workaround.
A structured patch and vulnerability management process can help organizations prioritize exposed systems while minimizing disruption to critical business applications.
SAP's public bulletin does not report confirmed active exploitation of the four maximum-severity vulnerabilities.
However, the combination of potential remote code execution, authentication bypass, and unauthorized system access makes November's release a priority for enterprise security teams.
Four perfect scores are enough to get everyone's attention. The real test is how quickly organizations can eliminate the exposure.
In other cybersecurity news, Samsung's November 2026 security update addresses critical Android vulnerabilities and Galaxy-specific flaws, including weaknesses that could allow remote code execution, unauthorized access to sensitive information, and other security breaches.