SAP fixes 38 flaws, including nine critical vulnerabilities

SAP published its November 2026 Security Patch Day, fixing 38 new CVEs across SAP NetWeaver, Web Dispatcher, Gateway and related components. Nine of these are rated Critical, with four carrying the maximum CVSS score of 10.0. The patches address flaws in NetWeaver AS ABAP and ABAP Platform, SAP Web Dispatcher, SAP Gateway, and SAP BusinessObjects components.

The article notes that, while none of the 38 CVEs has been confirmed as exploited, several of the Critical issues enable takeover or remote code execution on internet-facing systems, making prompt patching essential.

The notable Critical flaws include CVE-2026-120017 (CVSS 10.0) affecting SAP NetWeaver AS ABAP and ABAP Platform via SAML2 authentication assertions, and CVE-2026-89126 (CVSS 10.0) in SAP Web Dispatcher triggered by crafted network traffic leading to code execution. Additional 10.0 or near-10.0 flaws affect SAP Gateway (CVE-2026-89103), and SAP NetWeaver ABAP/ICM components (CVE-2026-76964).

Other high-severity issues include CVE-2026-76965 (9.9), CVE-2026-109803 (9.9), CVE-2026-109795 (9.9), and CVE-2026-89119 (9.6), with CVE-2026-109798 (9.1) affecting BusinessObjects Web Intelligence. Affected versions span SAP NetWeaver AS ABAP and ABAP Platform 702–920, SAP Web Dispatcher and kernel releases 7.53–7.54, 7.77, 7.93 and 9.16–9.20, SAP Gateway on kernel 7.22–9.21, plus various SAP BusinessObjects components.

Users should consult the SAP Security Notes for November 2026 and apply fixes, prioritising internet-facing systems first; where immediate patching is not possible, restrict access to SAP Gateway, Web Dispatcher and ICM ports and review SAML2 settings on ABAP systems. The article emphasises that patching remains the primary mitigant and that delays carry real risk.