SAP Patches Four Critical CVSS 10.0 Vulnerabilities, Including Two Enabling Remote Code Execution
SAP has released patches for four critical vulnerabilities, all rated CVSS 10.0, in its NetWeaver application server and Web Dispatcher, enabling unauthenticated remote code execution.
SAP has issued urgent patches for four severe vulnerabilities, each carrying the maximum CVSS 10.0 score, impacting its NetWeaver application server and Web Dispatcher. These flaws are particularly dangerous as they allow unauthenticated attackers to execute arbitrary code remotely, posing a significant threat to enterprise systems that rely on SAP software.
Two of the critical vulnerabilities reside within the SAP NetWeaver application server, the core software powering SAP systems. One affects the Internet Communication Manager (ICM), which handles web traffic, and the other targets the SAML 2.0 service provider, responsible for user sign-in processes. The fourth critical flaw is present in the SAP Web Dispatcher, a component that acts as a reverse proxy, directing incoming web requests to the application server.
The vulnerability in the ICM, identified as CVE-2026-76964, and the Web Dispatcher flaw, CVE-2026-89126, can be exploited by crafting malicious network traffic that corrupts memory. Successful exploitation allows an attacker to gain control of the affected system. Meanwhile, CVE-2026-120017, found in the SAML 2.0 service provider, could enable an attacker to impersonate any user on systems utilizing SAML single sign-on, potentially leading to a full system compromise.
A fourth critical flaw, CVE-2026-89103, impacts SAP Gateway, a component that facilitates communication between SAP systems and external programs. This vulnerability allows an attacker to impersonate one of the system's own servers, enabling them to perform unauthorized actions within the application environment. Notably, none of these four vulnerabilities require any prior authentication or user interaction to be exploited, making them prime targets for widespread attacks.
SAP has detailed the affected versions and provided specific SAP Notes for each vulnerability on its SAP for Me portal, urging customers to apply these patches as a top priority. The company's November security bulletin lists the affected components, corresponding CVE IDs, and the relevant SAP Notes, such as Note 3778530 for the ICM flaw and Note 3778556 for the Web Dispatcher flaw.
Security researchers, including those from RedRays, have analyzed the patches and recommend a comprehensive update strategy. This includes updating the kernel and all Web Dispatchers to incorporate all 17 fixes released this month for these components. Specific guidance is provided for each vulnerability, emphasizing that for the SAML2 flaw, there is no workaround, and patching is the only solution.
For the SAP Gateway vulnerability, security firms advise tightening default rules by setting the gw/acl_mode_proxy parameter and ensuring explicit rules are in place in secinfo and reginfo. For the ICM and Web Dispatcher flaws, disabling WebSocket support can serve as a temporary mitigation if direct access to ICM ports is not possible, though this may break dependent features.
The severity of these vulnerabilities underscores the critical importance of timely patching for SAP environments. The ability for unauthenticated attackers to achieve remote code execution means that any internet-facing SAP system, or internal systems accessible from less secure network segments, could be at immediate risk if not updated promptly. Organizations are strongly advised to consult the provided SAP Notes and implement the recommended patches without delay.
This update further details the vulnerabilities patched during SAP's November 2026 Security Patch Day, specifically highlighting four critical flaws with CVSS 10.0 scores. The article provides specific CVE identifiers and SAP Security Notes for these critical issues, including CVE-2026-76964 in NetWeaver AS ABAP's ICM, CVE-2026-89126 in Web Dispatcher, CVE-2026-89103 in Gateway, and CVE-2026-120017 in NetWeaver AS ABAP's SAML2 Service Provider, all of which allow for unauthenticated exploitation.