Patching

SAP November 2026 patches: four flaws at CVSS 10.0

By Yaali. November 10, 2026, 6 min read, Patching, Vulnerabilities.

SAP's November 10 Patch Day fixes a SAML2 login bypass, a Gateway ACL flaw and two kernel memory bugs, all CVSS 10.0. What to patch first and how to check.

SAP released its November security fixes on Tuesday, November 10. Nine are rated critical, and four of those carry the maximum CVSS score of 10.0: a login bypass in the SAML2 single sign-on of NetWeaver AS ABAP, an access control flaw in SAP Gateway, and memory corruption bugs in the Internet Communication Manager (ICM) and SAP Web Dispatcher. All four can be triggered over the network with no account. If you run any ABAP-based system, on any SAP_BASIS release from 702 up to 922, at least one of them applies to you.

SecurityOnline counts 38 new CVE records for the month; the National Vulnerability Database (NVD) lists 40 CVEs that SAP, acting as its own CVE numbering authority, published on November 10. Neither source reports exploitation, and none of the nine critical CVEs was in the CISA Known Exploited Vulnerabilities (KEV) catalog as of its November 9 release. That leaves a short window to patch before anyone reverse engineers the fixes.

How the four CVSS 10.0 flaws work

CVE-2026-120017, SAML2 Service Provider, note 3849308. When an ABAP system accepts SAML 2.0 single sign-on, the identity provider (Entra ID, Okta, SAP Cloud Identity and so on) sends a signed XML assertion saying who the user is. The ABAP system, acting as the service provider, must check that signature against the identity provider's trusted certificate before it logs anyone in. SAP's CVE record files this under CWE-347, improper verification of a cryptographic signature: under certain configurations the check is not strict enough, so an attacker can submit a crafted assertion and be logged in as any user, including administrators. SAP has not said which configurations are affected. The record lists SAP_BASIS 702, 731, 740, 750 to 758, 816 and 920 to 922.

CVE-2026-89103, SAP Gateway, note 3798345. The Gateway is the process that brokers Remote Function Call (RFC) traffic, SAP's protocol for system-to-system calls, usually on TCP port 33NN (48NN for secure connections), where NN is the instance number. It decides which hosts may register programs or start them using two access control lists (ACLs), secinfo and reginfo. When those files are missing, a built-in default ACL applies. According to the CVE record, that default is too generous and can classify an external attacker as an internal application server of the same system, which the Gateway trusts far more than an outside host. An unauthenticated attacker who can reach the port can then perform actions in the system that should be refused, with high impact on confidentiality, integrity and availability. The listed kernels run from 7.22 to 9.21.

CVE-2026-76964 (ICM, note 3778530) and CVE-2026-89126 (Web Dispatcher, note 3778556). The ICM handles HTTP for ABAP systems, and Web Dispatcher is the reverse proxy that often sits in front of them on the internet edge. Both share code from the SAP kernel. In each case an internal component fails to validate network input, and crafted traffic corrupts memory; the CVE record for 89126 classifies it as a heap-based buffer overflow (CWE-122). Both records state the result as arbitrary code execution and full compromise, with no login needed. Web Dispatcher builds listed include WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20, plus the copies shipped with HANA 2.0 and XS Advanced.

The other five critical fixes

Three score 9.9 and need only a low-privileged account. CVE-2026-76965 (note 3792735) lets such a user run operating system commands on the ABAP host through kernel functionality that lacks an authorization check. CVE-2026-109795 (note 3834842) is a code injection through a remote-enabled function in the CRM components S4CRM 204 to 206, S4CEXT 107 to 109 and BBPCRM 713 and 714. CVE-2026-109803 (note 3809153) lets a user of Knowledge Management XML Forms (KMC-CM 7.50) pick an unauthorized XSL transformation and run code on the Java portal.

CVE-2026-89119 (9.6, note 3804858) is cross-site request forgery against the administration functions of Web Dispatcher and ICM: an administrator who opens an attacker's link while logged in can hand over the host. CVE-2026-109798 (9.1, note 3799117) is an XML external entity flaw in BusinessObjects Web Intelligence OLAP connections that reads server files and reaches internal systems.

Just below the critical line, CVE-2026-76966 (8.9, note 3769130) is another unauthenticated memory corruption bug, this time in the kernel's RFC handling. Patch it in the same kernel update.

What attackers are doing

Nothing public yet. No proof of concept has been indexed for the CVSS 10.0 flaws, and none are in KEV. SAP systems are a proven target: in April 2025 a missing authorization check in NetWeaver Visual Composer, CVE-2025-31324 (CVSS 10.0), was exploited as a zero-day to plant web shells on internet-facing servers. An unauthenticated bug in Web Dispatcher, which by design faces the internet, belongs in this week's change window.

What to do

1. Find the exposure. List every Web Dispatcher and ICM port reachable from the internet (icm/server_port_<n> in the instance profile shows what each one listens on). In each ABAP client, run transaction SAML2 to see whether SAML 2.0 is enabled and which identity providers are trusted.
2. Update the kernel and Web Dispatcher first. CVE-2026-76964, 89126, 89103, 76965 and 76966 are fixed in kernel and Web Dispatcher binaries. These are replaced with SAPCAR archives and a restart, not implemented through SNOTE, so they need a downtime window. Take the patch levels from notes 3778530, 3778556, 3798345 and 3792735.
3. Implement the ABAP and Java notes: 3849308 for SAML2, then 3834842 for CRM, 3809153 for Knowledge Management, 3799117 for BusinessObjects and 3804858 for the admin CSRF.
4. Close the Gateway. Until the kernel is updated, block ports 33NN and 48NN at the firewall so only your own application servers and known RFC partners can reach them. In SMGW, under Goto, Expert Functions, External Security, confirm that secinfo and reginfo files exist and are loaded, and that profile parameter gw/acl_mode is set to 1, so the permissive default never applies.
5. If SAML2 cannot be patched today, consider switching it off in the SAML2 transaction for internet-facing clients and falling back to another login method. That is our suggestion rather than SAP guidance, so read note 3849308 for any official workaround first.

To look for earlier abuse, read the Security Audit Log (transaction RSAU_READ_LOG) for logons by SAP*, DDIC and other privileged users from unfamiliar terminals or at unusual hours, and for new users or role changes you cannot explain. In the Gateway log (SMGW, Goto, Expert Functions, Logging), look for program registrations or starts from hosts that are not your servers. In the Web Dispatcher work directory, check dev_webdisp for unexpected crashes or restarts, which can be failed exploit attempts. If anything turns up, reset the passwords of affected administrators and the credentials stored in RFC destinations (SM59) that those systems use.

Kernel patches belong in the plan

Five of this month's most serious fixes, including three of the four 10.0s, live in the kernel or Web Dispatcher rather than in ABAP code. Many SAP teams apply notes promptly through SNOTE but update kernels once or twice a year, because it needs a restart. Months like this one show why the kernel and Web Dispatcher need their own regular, rehearsed update path, with the edge proxy at the front of the queue.

If you want to know which SAP systems and ports are visible from outside, our attack surface management team can map them, and safeguarding and hardening can review Gateway ACLs and SAML trust settings. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

Sources: SAP Security Notes and News, CVE-2026-120017 record, NVD CVE-2026-89103, NVD CVE-2026-89126, NVD CVE-2026-76964, NVD CVE-2026-76965, SecurityOnline, Strix on CVE-2026-120017, TheHackerWire on CVE-2026-89126, TheHackerWire on CVE-2026-89119, CISA KEV catalog, Rapid7 on CVE-2025-31324.