SAP patches four maximum severity flaws across its systems

SAP has released patches for four CVSS 10.0 flaws across its NetWeaver and related components as part of its monthly Security Patch Day. The Web Dispatcher and Internet Communication Manager (ICM) flaws could let an attacker on the network execute code, while the SAML 2.0 service provider issue could enable an attacker to log in as any user on systems using SAML-based single sign-on, and the SAP Gateway flaw could allow an attacker to impersonate one of the system’s own servers and perform unauthorized actions.

All four vulnerabilities require no user action to be exploited. SAP has fixed each flaw in its own security note, with the specific notes being 3778530 (ICM), 3778556 (Web Dispatcher), 3798345 (Gateway) and 3849308 (SAML2). The affected versions and kernel components vary by note, and SAP notes are published in SAP for Me (which requires sign-in).

RedRays, a third-party reviewer, recommends a rollout that covers all kernel and Web Dispatcher fixes in a single update pass, noting that the fixes touch 17 kernel and Web Dispatcher components this month.

The CVEs and affected versions show distinct consequences: CVE-2026-76964 targets ICM and ICM-related WebSocket handling, CVE-2026-89126 affects Web Dispatcher (and related WebSocket traffic), CVE-2026-89103 concerns SAP Gateway’s access control, and CVE-2026-120017 concerns the SAML2 service provider across multiple SAP BASIS releases.

The report explains the practical risk and the vendor’s guidance for patching, emphasising that the fixes should be applied promptly and that administrators should review their SAP NetWeaver and Web Dispatcher deployments to ensure all affected instances are updated.