Cyber SecurityNews

SAP’s November Security Update Fixes Four Vulnerabilities Rated 10.0

4 mins

SAP released 35 new security notes on November 10, 2026, including fixes for four vulnerabilities that received a 10.0, the highest score on the Common Vulnerability Scoring System (CVSS). The four fixes cover SAP Web Dispatcher, SAP Gateway, and two components of SAP NetWeaver AS ABAP. One of the NetWeaver fixes also applies to ABAP Platform.

Two of the highest-rated flaws affect components that handle web traffic. Memory corruption in Web Dispatcher and in the Internet Communication Manager can allow code to run remotely on affected systems. The other two involve access controls. A flaw in the SAML 2.0 service provider can undermine single sign-on on affected configurations, while a separate weakness in SAP Gateway can allow unauthorized actions.

The release also includes critical fixes for S4CRM, the Web Intelligence component of SAP BusinessObjects, and NetWeaver Knowledge Management. For ERP teams, that puts reporting, customer management, web access, and integrations on the same patch review as the ABAP application servers. SAP recommends prioritizing the patches. France’s national computer emergency response team, CERT-FR, issued a separate advisory on November 10 and directed organizations to SAP for the fixes.

SAP issued 35 new security notes in November 2026, including fixes for four vulnerabilities rated 10.0 across NetWeaver, ABAP Platform, Web Dispatcher, and Gateway.

All 35 new SAP security notes

SAP rated nine of the new notes Critical, 13 High, 12 Medium, and one Low. The scores below are those shown for each note in SAP’s bulletin. Where a note covers more than one CVE, the individual CVE scores can differ.

Critical priority

  • 3778530 (10.0), CVE-2026-76964. Fixes memory corruption in the Internet Communication Manager, which handles web traffic for NetWeaver AS ABAP.
  • 3778556 (10.0), CVE-2026-89126. Fixes memory corruption in SAP Web Dispatcher, which routes web requests to SAP application servers.
  • 3798345 (10.0), CVE-2026-89103. Corrects an access-control weakness in SAP Gateway that could permit unauthorized actions.
  • 3849308 (10.0), CVE-2026-120017. Adds a missing authentication check in the SAML 2.0 service provider used for single sign-on in NetWeaver AS ABAP and ABAP Platform.
  • 3809153 (9.9), CVE-2026-109803. Addresses a code injection flaw in XML Forms, part of SAP NetWeaver Knowledge Management.
  • 3792735 (9.9), CVE-2026-76965. Addresses a flaw that could allow unauthorized operating system commands to run through the ABAP application server.
  • 3834842 (9.9), CVE-2026-109795. Adds a missing permissions check in S4CRM and related CRM components.
  • 3804858 (9.6), CVE-2026-89119 and CVE-2026-120014. Addresses cross-site request forgery in Web Dispatcher and Internet Communication Manager, where a signed-in user’s browser could be made to submit an unintended request.
  • 3799117 (9.1), CVE-2026-109798. Fixes unsafe handling of external XML entities in the Web Intelligence reporting component of SAP BusinessObjects BI Platform.

High priority

  • 3769130 (8.9), CVE-2026-76966 and CVE-2026-109796. Addresses two ABAP application server flaws, one involving memory corruption and the other potential exposure of memory contents.
  • 3809953 (8.2), CVE-2026-120008. Fixes memory corruption in the Internet Graphics Service used by SAP NetWeaver.
  • 3803832 (7.7), CVE-2026-109800. Covers a separate memory corruption issue in SAP Web Dispatcher.
  • 3808627 (7.5), CVE-2026-109793. Addresses a flaw that could interrupt service in NetWeaver AS ABAP’s Internet Communication Manager and in Web Dispatcher.
  • 3805570 (7.5), CVE-2026-120010. Fixes memory corruption in the SAP Message Server component of NetWeaver Application Server.
  • 3809934 (7.5), CVE-2026-109806 and CVE-2026-109807. Addresses two additional Internet Graphics Service flaws involving an out-of-bounds memory read and an integer overflow.
  • 3792915 (7.5), CVE-2026-76970. Fixes a separate memory corruption issue in the ABAP application server used by NetWeaver and ABAP Platform.
  • 3808552 (7.5), CVE-2026-109804. Addresses unintended information disclosure from SAP Message Server in NetWeaver.
  • 3810485 (7.5), CVE-2026-89114. Adds a missing authentication check to the EDM application in NetWeaver Application Server Java.
  • 3789273 (7.5), CVE-2026-76973. Fixes another memory corruption issue in Message Server for NetWeaver AS ABAP and ABAP Platform.
  • 3805681 (7.5), CVE-2026-109794. Addresses a separate service disruption risk affecting NetWeaver AS ABAP, ABAP Platform, and Web Dispatcher.
  • 3842766 (7.5), CVE-2026-120015. Addresses insufficient input checks in SAP Host Agent, which helps administer and monitor SAP systems.
  • 3833364 (7.2), CVE-2026-120009. Fixes a code injection issue in the AMDP Data Preview feature of SAP ABAP Developer Tools.

Medium priority

  • 3793716 (6.5), CVE-2026-109802. Addresses a denial-of-service flaw in NetWeaver Application Server for ABAP.
  • 3805959 (6.5), CVE-2026-109811. Fixes a server-side request forgery flaw that could cause the ABAP application server to send unintended requests.
  • 3839977 (6.5), CVE-2026-109801 and CVE-2026-109809. Addresses two authorization weaknesses in the NWDI Cockpit for NetWeaver Application Server Java.
  • 3786876 (6.4), CVE-2026-109805. Addresses weak cryptographic protections in the ABAP application server used by NetWeaver and ABAP Platform.
  • 3806484 (6.1), CVE-2026-120016. Fixes cross-site scripting in NetWeaver Visual Composer, where injected script could run in a user’s browser.
  • 3797108 (6.1), CVE-2026-109810. Addresses CSS injection in Web Dynpro Java, a framework for browser-based SAP interfaces.
  • 3782056 (6.0), CVE-2026-89125. Addresses unsafe storage of sensitive information in Web Dispatcher and Internet Communication Manager.
  • 3835738 (5.8), CVE-2026-89129. Fixes a server-side request forgery issue in the web services component of NetWeaver AS Java.
  • 3792447 (5.3), CVE-2026-89128. Corrects an access-control weakness in the Process Integration Test Tool for SAP NetWeaver.
  • 3803144 (4.4), CVE-2026-73635. Addresses a denial-of-service issue affecting SAP BusinessObjects and its client tools.
  • 3740168 (4.4), CVE-2026-89115. Addresses information exposure in SAP Start Service and the SAP Microsoft Management Console.
  • 3801587 (4.3), CVE-2026-89131. Fixes cross-site request forgery in NetWeaver Enterprise Portal, where a user’s browser could be made to send an unintended request.

Low priority

  • 3802244 (3.1), CVE-2026-109808. Adds a missing authorization check in the SAP Solution Tools Plug-In (ST-PI).

Four GitHub advisories and three revisions

SAP also published four GitHub advisories covering the SAP Cloud SDK for Python, the SAP Cloud SDK for AI for JavaScript, and the SAP/astonish repository. It separately revised three existing security notes. One covers SAP GUI for HTML applications, and two cover SAP WebClient UI.

SAP’s bulletin lists the affected versions for each component. ERP teams can use the note numbers to match fixes against installed kernel, SAP_BASIS, and component versions, then coordinate changes to Web Dispatcher, single sign-on, and Gateway with the teams that operate the applications and integrations that depend on them.

ERP News Editorial Team
+ posts

The ERPNews Editorial Team covers global developments in ERP (Enterprise Resource Planning), enterprise software, cloud platforms, AI, automation, and digital transformation, providing independent news and editorial analysis for senior business and technology leaders. Our reporting focuses on market signals, strategic shifts, and enterprise impact across the ERP and enterprise technology ecosystem.

For editorial inquiries, please contact:
📩 [email protected]

 

Tags:
Cats:
Cyber SecurityNewsSAP
Shares: