Critical CVSS 10.0 Security news
SAP Security Patch Day November 2026: four flaws with a perfect CVSS 10 score
On Tuesday 10 November 2026 SAP released 35 new security notes, nine of them Critical. Four flaws carry the maximum CVSS score of 10.0 and sit in core SAP components: the Internet Communication Manager, Web Dispatcher, SAP Gateway and SAML sign-in. SAP has not reported exploitation so far. If you run SAP NetWeaver or S/4HANA, schedule the kernel and SAP_BASIS updates as soon as you can.
Key points
- Who is affected: administrators of SAP NetWeaver AS ABAP, SAP Web Dispatcher, S/4HANA CRM and BusinessObjects BI. The four CVSS 10.0 flaws are in the kernel and SAP_BASIS, so they reach almost every ABAP system.
- According to NVD, three of them (CVE-2026-76964 in ICM, CVE-2026-89126 in Web Dispatcher, CVE-2026-89103 in SAP Gateway) can be exploited over the network without authentication. The fourth (CVE-2026-120017) lets an attacker sign in as any user under certain SAML2 configurations.
- Exploitation: neither SAP nor CISA reports any as of 10 November 2026, and no technical write-up or indicators have been published.
- What to do: apply notes 3778530, 3778556, 3798345 and 3849308 (kernel and SAP_BASIS), restrict network access to ICM, Gateway and Web Dispatcher, and review the Gateway ACLs.
Vulnerabilities: CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017, CVE-2026-109803, CVE-2026-76965, CVE-2026-109795, CVE-2026-89119, CVE-2026-109798
What happened
On Tuesday 10 November 2026 SAP published 35 new security notes, 4 GitHub security advisories and 3 updates to older notes as part of its monthly Security Patch Day. Nine fixes are rated Critical, and four of those get the maximum CVSS 3.1 score of 10.0. All four are in core components that run in nearly every SAP NetWeaver AS ABAP and S/4HANA landscape.
| CVE | Component | SAP note | CVSS | Login needed |
|---|---|---|---|---|
| CVE-2026-76964 | Internet Communication Manager (ICM) | 3778530 | 10.0 | no |
| CVE-2026-89126 | SAP Web Dispatcher | 3778556 | 10.0 | no |
| CVE-2026-89103 | SAP Gateway | 3798345 | 10.0 | no |
| CVE-2026-120017 | SAML2 Service Provider (SAP_BASIS) | 3849308 | 10.0 | no (certain configurations) |
| CVE-2026-109803 | NetWeaver Knowledge Management (XML Forms) | 3809153 | 9.9 | yes, low privileges |
| CVE-2026-76965 | ABAP application server (kernel) | 3792735 | 9.9 | yes, low privileges |
| CVE-2026-109795 | S/4HANA CRM | 3834842 | 9.9 | yes, low privileges |
| CVE-2026-89119 | Web Dispatcher and ICM (CSRF) | 3804858 | 9.6 | no, but an admin must click |
| CVE-2026-109798 | BusinessObjects BI (Web Intelligence) | 3799117 | 9.1 | yes |
Technical details
Everything below comes from the CVE records SAP filed in NVD (NVD had not analysed them yet on 10 November). No independent research write-up has been published so far.
- CVE-2026-76964 – ICM: memory corruption (CWE-1287) when handling crafted network traffic. SAP says an unauthenticated attacker could execute arbitrary code and fully compromise the system. ICM is the component that serves HTTP and HTTPS in an ABAP system.
- CVE-2026-89126 – Web Dispatcher: a heap-based buffer overflow (CWE-122) triggered by unauthenticated network input, with possible code execution. Besides the standalone Web Dispatcher it also affects XS Advanced and HANA (HDB 2.00).
- CVE-2026-89103 – SAP Gateway: incorrect authorization (CWE-863). The Gateway's default access control list treats external clients as internal application servers and grants them high privileges, so an attacker with network access to the Gateway can act inside the system without logging in.
- CVE-2026-120017 – SAML2: improper verification of a cryptographic signature (CWE-347). Under certain configurations the system does not properly verify incoming authentication assertions, letting an attacker sign in as any user, including administrators. Affects SAP_BASIS 702 to 922.
We do not publish exploitation details.
Who is affected
- ICM (CVE-2026-76964): kernel 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20.
- Web Dispatcher (CVE-2026-89126): WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1; kernel 7.53, 9.18, 9.20; HDB 2.00.
- SAP Gateway (CVE-2026-89103): kernel 7.22, 7.22EXT, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20 and 9.21.
- SAML2 (CVE-2026-120017): SAP_BASIS 702, 731, 740, 750–758, 816 and 920–922 – only systems with SAML2 sign-in enabled and the "certain configuration" that SAP describes in note 3849308 but not publicly.
The highest risk is to systems whose Web Dispatcher or ICM is reachable from the internet (portals, Fiori, partner interfaces), and to networks where anyone on the internal LAN can reach the SAP Gateway (ports 33NN).
How to tell if you were compromised
SAP has not published indicators of compromise and does not mention attacks. Here is what we suggest watching (our own advice, not SAP guidance):
- Crashes and restarts of ICM, Web Dispatcher and Gateway processes (dev_icm, dev_webdisp, dev_rd) – memory corruption often shows up as a crash first.
- Gateway logs and registered programs from unknown hosts (SMGW), new RFC connections and programs started through the Gateway.
- SAML sign-ins to administrator accounts from unusual locations or at unusual times (Security Audit Log, SM20/RSAU_READ_LOG).
- New users and authorization changes, especially SAP_ALL and SAP_NEW.
If SAP or a CERT publishes indicators later, you can pull them out of the advisory with our IOC extractor. Recalculate the vectors from the CVE records in the CVSS calculator.
What to do
- Update the kernel on every ABAP application server and on the Web Dispatcher according to notes 3778530, 3778556 and 3798345. One kernel update fixes several of these at once.
- Apply note 3849308 (SAML2, SAP_BASIS) if you use SAML sign-in – typically Fiori or a portal with single sign-on.
- Restrict network access: the SAP Gateway and Message Server should not be reachable from the internet or the general user network. Expose only the Web Dispatcher at the edge, and only the paths you need.
- Review the Gateway ACLs (secinfo and reginfo) – CVE-2026-89103 abuses the default setting. After patching, make sure no rule allows all hosts.
- Then deal with the other Critical notes – S/4HANA CRM (3834842), Knowledge Management (3809153), BusinessObjects (3799117) and OS command execution in the kernel (3792735).
Timeline
Updates
- 10 Nov 2026 – first version of this article.
FAQ
Are these flaws being exploited?
As of 10 November 2026 SAP's Security Patch Day page does not say so and none of the flaws is in CISA's KEV catalog. SAP systems do tend to be targeted soon after fixes ship, as attackers compare patched and unpatched kernels, so do not leave this for the next quarterly window.
Why can't I open the SAP notes?
SAP security notes are only available to customers who sign in to the SAP support portal. The public sources are the Security Patch Day overview and the CVE records in NVD, which this article is based on.
Does this affect RISE with SAP or other hosted systems?
Who applies the fixes on systems run under RISE with SAP or by another provider depends on your contract, so check with your provider. The release also includes four GitHub advisories: three for SAP Cloud SDK libraries (Python and JavaScript) and one for the SAP/astonish project. Application developers have to update those libraries themselves.
Is patching the Web Dispatcher at the edge enough?
No. The ICM, SAP Gateway and SAML2 flaws live on the ABAP application servers, and the Web Dispatcher is a separate fix. Update the kernel on every application server and on the Web Dispatcher.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
Arara Message breach: 81 million email addresses stolen and phishing sent in card issuers' names
An attacker broke into Arara Message, a Japanese bulk email delivery service, took more than 81 million email addresses belonging to the customers of roughly 380 companies, and used the service itself to send up to 7.13 million phishing emails posing as credit card companies. The fallout is now reaching downstream customers: on 13 November 2026 the City of Osaka disclosed that 1.08 million addresses of users of its online services system were exposed. Here is what is confirmed and what it means for defenders and users.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
Exploited UnrealIRCd flaw CVE-2026-114713 lets any user run commands with server authority
On Friday 13 November 2026 CISA added CVE-2026-114713, a flaw in the UnrealIRCd IRC server, to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to fix it. The bug in the labeled-response module lets any user on a network with two or more linked servers inject server-to-server commands that are executed with server authority, such as KILL or GLINE. The project's maintainer called it the most critical UnrealIRCd issue in 15 years. The fix shipped on 7 November as version 6.2.7.1 and as a hot-patch that needs no restart.