SAP’s November 2026 Security Patch Day covers critical vulnerabilities in SAP NetWeaver, Web Dispatcher, Gateway, and other business applications. Released on November 10, the update includes 35 new security notes, four GitHub security advisories, and three updates to earlier notes.
Highest-risk SAP flaws span NetWeaver and gateway tools
Four vulnerabilities in the release carry the maximum CVSS score of 10.0. The patched issues include memory corruption, missing authentication, broken access control, and code injection flaws, and SAP says customers should use its security support portal and apply the relevant corrections promptly.
Among the most serious items is CVE-2026-76964, a memory corruption flaw in SAP NetWeaver AS ABAP’s Internet Communication Manager. The published CVE record says the software does not properly validate certain network input, and an attacker without credentials could send crafted traffic, trigger memory corruption, and potentially execute arbitrary code, fully compromising the affected system.
SAP Security Note 3778530 covers that issue. The affected releases listed for it are KRNL64UC 7.53 and KERNEL versions 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, and 9.20. Its CVSS vector shows network access, low attack complexity, and no privilege or user interaction requirement.
The other 10.0-rated flaws are CVE-2026-89126 in SAP Web Dispatcher, covered by Note 3778556; CVE-2026-89103 in SAP Gateway, covered by Note 3798345; and CVE-2026-120017, a missing authentication issue in the SAML2 Service Provider inside SAP NetWeaver AS ABAP and ABAP Platform. Note 3849308 covers affected SAP_BASIS releases from selected older versions through 922, and all four vectors show that exploitation requires neither credentials nor user interaction.
Additional high-severity notes include unauthenticated and lower-privilege issues
SAP lists three more critical notes at CVSS 9.9. They cover CVE-2026-109803 in NetWeaver Knowledge Management XML Forms, CVE-2026-76965 in the ABAP Application Server, and CVE-2026-109795 in S4CRM. Their vectors require low-level privileges, which separates them from the four maximum-severity issues that do not need authentication.
The release also includes further high and medium-high findings across SAP products. One group of 9.6-rated issues covers CVE-2026-89119 and CVE-2026-120014 in Web Dispatcher and ICM, both tied to cross-site request forgery. Another 9.1-rated item affects SAP BusinessObjects Web Intelligence through XML external entity injection. The bulletin also lists multiple 7.5, 7.2, 7.1, 6.5, 6.4, 6.1, 6.0, 5.8, 5.4, 5.3, 4.4, 4.3, 4.1, and 3.1 findings across NetWeaver, Web Dispatcher, Cloud SDK components, Host Agent, BusinessObjects, SAP GUI for HTML, WebClient UI, and Solution Tools Plug-In.
| Security Note / Advisory | CVE ID | CVSS | Affected Product / Component | Vulnerability | |—|—|—|—|—|
| | 3778530 | CVE-2026-76964 | 10.0 | SAP NetWeaver AS ABAP – ICM | Memory corruption | |
|---|---|---|---|---|
| | 3778556 | CVE-2026-89126 | 10.0 | SAP Web Dispatcher | Memory corruption | |
| | 3798345 | CVE-2026-89103 | 10.0 | SAP Gateway | Broken access control | |
| | 3849308 | CVE-2026-120017 | 10.0 | SAP NetWeaver AS ABAP – SAML2 Service Provider | Missing authentication | |
| | 3809153 | CVE-2026-109803 | 9.9 | SAP NetWeaver Knowledge Management – XML Forms | Code injection | |
| | 3792735 | CVE-2026-76965 | 9.9 | SAP NetWeaver – ABAP Application Server | OS command injection | |
| | 3834842 | CVE-2026-109795 | 9.9 | SAP S4CRM | Missing authorization check | |
| | 3804858 | CVE-2026-89119, CVE-2026-120014 | 9.6 | SAP Web Dispatcher, ICM | Cross-site request forgery | |
| | 3799117 | CVE-2026-109798 | 9.1 | SAP BusinessObjects Web Intelligence | XML external entity injection | |
| | 3769130 | CVE-2026-76966, CVE-2026-109796 | 8.9 | SAP NetWeaver – ABAP Application Server | Multiple vulnerabilities | |
| | 3809953 | CVE-2026-120008 | 8.2 | SAP NetWeaver – Internet Graphics Service | Memory corruption | |
| | 3803832 | CVE-2026-109800 | 7.7 | SAP Web Dispatcher | Memory corruption | |
| | GHSA-93m8-crj2-v997 | CVE-2026-109799 | 7.5 | SAP Cloud SDK for Python – IASContextProvider | JWT signature verification flaw | |
| | 3808627 | CVE-2026-109793 | 7.5 | SAP NetWeaver ICM, Web Dispatcher | Denial of service | |
| | 3805570 | CVE-2026-120010 | 7.5 | SAP NetWeaver – Message Server | Memory corruption | |
| | 3809934 | CVE-2026-109806, CVE-2026-109807 | 7.5 | SAP NetWeaver – Internet Graphics Service | Multiple vulnerabilities | |
| | 3792915 | CVE-2026-76970 | 7.5 | SAP NetWeaver – ABAP Application Server | Memory corruption | |
| | 3808552 | CVE-2026-109804 | 7.5 | SAP NetWeaver – Message Server | Information disclosure | |
| | 3810485 | CVE-2026-89114 | 7.5 | SAP NetWeaver AS Java – EDM Application | Missing authentication | |
| | 3789273 | CVE-2026-76973 | 7.5 | SAP NetWeaver – Message Server | Memory corruption | |
| | 3805681 | CVE-2026-109794 | 7.5 | SAP NetWeaver AS ABAP, ABAP Platform, Web Dispatcher | Denial of service | |
| | GHSA-28c8-457r-4cf6 | CVE-2026-120013 | 7.5 | SAP Cloud SDK for Python – Agent Memory Module | Path traversal | |
| | GHSA-8g7j-49xg-8wf3 | CVE-2026-120012 | 7.5 | SAP Cloud SDK for AI – JavaScript | Information disclosure | |
| | 3842766 | CVE-2026-120015 | 7.5 | SAP Host Agent | Insufficient input validation | |
| | 3833364 | CVE-2026-120009 | 7.2 | SAP ABAP Developer Tools – AMDP Data Preview | Code injection | |
| | GHSA-93c9-96j8-4vg9 | CVE-2026-109797 | 7.1 | SAP/astonish | Cross-tenant sandbox takeover | |
| | 3793716 | CVE-2026-109802 | 6.5 | SAP NetWeaver AS ABAP | Denial of service | |
| | 3805959 | CVE-2026-109811 | 6.5 | SAP NetWeaver – ABAP Application Server | Server-side request forgery | |
| | 3839977 | CVE-2026-109801, CVE-2026-109809 | 6.5 | SAP NetWeaver AS Java – NWDI Cockpit | Multiple vulnerabilities | |
| | 3786876 | CVE-2026-109805 | 6.4 | SAP NetWeaver – ABAP Application Server | Weak cryptography | |
| | 3806484 | CVE-2026-120016 | 6.1 | SAP NetWeaver Visual Composer | Cross-site scripting | |
| | 3797108 | CVE-2026-109810 | 6.1 | SAP NetWeaver AS Java – Web Dynpro Java | CSS injection | |
| | 3782056 | CVE-2026-89125 | 6.0 | SAP Web Dispatcher, ICM | Insecure storage of sensitive information | |
| | 3835738 | CVE-2026-89129 | 5.8 | SAP NetWeaver AS Java – Web Services | Server-side request forgery | |
| | 3671819 (Updated) | CVE-2026-76976 | 5.4 | SAP NetWeaver AS ABAP – SAP GUI for HTML | Cross-site scripting | |
| | 3792447 | CVE-2026-89128 | 5.3 | SAP NetWeaver Process Integration – Test Tool | Broken access control | |
| | 3803144 | CVE-2026-73635 | 4.4 | SAP BusinessObjects | Denial of service | |
| | 3740168 | CVE-2026-89115 | 4.4 | SAP Start Service, SAP MMC | Information disclosure | |
| | 3801587 | CVE-2026-89131 | 4.3 | SAP NetWeaver Enterprise Portal | Cross-site request forgery | |
| | 3155685 (Updated) | CVE-2026-44768 | 4.1 | SAP WebClient UI | Security misconfiguration | |
| | 3101986 (Updated) | Not listed | 4.1 | SAP WebClient UI | CSP support preparation | |
| | 3802244 | CVE-2026-109808 | 3.1 | SAP Solution Tools Plug-In – ST-PI | Missing authorization check | |
GitHub advisories add Python, JavaScript, and cross-tenant issues
SAP also patched the GitHub advisories tied to its developer-facing tools. The list includes improper JWT signature verification in SAP Cloud SDK for Python versions below 0.63.1, path traversal in the Agent Memory module, and a cross-tenant sandbox takeover issue in SAP/astonish.
The bulletin follows October’s SAP security updates, which also fixed critical code injection and access control weaknesses. SAP says September patches covered additional NetWeaver and cloud risks as well, and it frames the monthly releases as something to track in sequence rather than separately.
Patch guidance centers on version checks and testing
Security teams are told to match installed component versions against the November notes, prioritize reachable systems affected by critical flaws, and test patches before deploying them to production. The bulletin does not report active exploitation, and the severity scores are presented as technical risk rather than evidence that attackers have already compromised vulnerable installations.
Licensed under CC BY-ND 4.0 International