As reported by The Hacker News, SAP's November 2026 Security Patch Day delivers fixes for four vulnerabilities all rated CVSS 10.0 — and none require authentication to exploit. This is the kind of batch that keeps ERP administrators awake: critical severity, unauthenticated, and sitting in components that frequently face the internet or handle core business logic.
Why This Matters
SAP NetWeaver is the foundation for SAP's business-critical applications — S/4HANA, BW, Solution Manager, and countless industry modules. When the application server or its front-line Web Dispatcher can be compromised without credentials, attackers gain a direct path to the data and processes that run the enterprise. Two of these flaws enable remote code execution, which means full system compromise is achievable from the network alone.
The Web Dispatcher is particularly concerning from an exposure standpoint. It's the component designed to sit at the network edge, receiving HTTP requests and forwarding them inward. If that perimeter component is vulnerable to memory-corruption-based RCE, any organization that hasn't restricted internet-facing access is essentially handing an attacker the keys to their SAP landscape.
Vulnerability Details
| CVE | Component | Impact | SAP Note |
|---|---|---|---|
| CVE-2026-76964 | Internet Communication Manager (ICM), NetWeaver AS ABAP | Unauthenticated RCE via memory corruption | 3778530 |
| CVE-2026-89126 | SAP Web Dispatcher | Unauthenticated RCE via memory corruption | 3778556 |
| CVE-2026-89103 | SAP Gateway | Server impersonation, ACL bypass, unauthorized actions | 3798345 |
| CVE-2026-120017 | SAML2 Service Provider, NetWeaver AS ABAP / ABAP Platform | Authentication bypass — log in as any user, including privileged accounts | 3849308 |
All four are rated Critical (CVSS 10.0). No user interaction is required for exploitation.
The SAML Flaw Deserves Special Attention
CVE-2026-120017 is arguably the most insidious of the four. While RCE grabs headlines, an authentication bypass in SAML single sign-on means an attacker can assume the identity of any user — including administrative accounts — on affected systems. This can cascade into connected applications and downstream services that trust the SAML assertion. Notably, SAP fixed a related but lower-severity SAML flaw (CVE-2026-44748) in June; organizations that deferred that patch may now face compounded exposure.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Patch now. Apply SAP Notes 3778530, 3778556, 3798345, and 3849308 to all affected systems. Treat this as an emergency change, not a routine monthly patch.
- Isolate internet-facing Web Dispatchers. If patching cannot be completed immediately, restrict network access to Web Dispatcher and ICM ports using firewall rules, VPN, or IP allowlisting. No SAP Web Dispatcher should be directly internet-exposed without justification.
- Audit SAML configurations. If you cannot immediately patch CVE-2026-120017, consider temporarily disabling SAML SSO for SAP or enforcing additional authentication factors for privileged accounts.
- Review Gateway ACLs. Verify that SAP Gateway access control lists are restrictive. If the gateway accepts connections from any host, remediate that configuration immediately — it compounds the risk of CVE-2026-89103.
- Deploy detection. Monitor for anomalous network traffic patterns targeting ICM and Web Dispatcher, and watch for SAML assertions originating from unexpected identity providers or claiming unexpected principal names.
Broader Implications
Four unauthenticated critical vulnerabilities in a single patch cycle is a signal that the attack surface of SAP's core platform remains broader than many assume. Organizations that treat SAP as a 'back-office system' immune to internet-facing threats are misjudging their exposure. Every SAP component that touches the network — including dispatchers, gateways, and identity integration — is a perimeter component now.
Patch cadence matters. The June SAML fix and this November batch suggest a pattern of discovery in NetWeaver's authentication and network handling code. Security teams should assume more findings will follow and build their SAP hardening roadmap accordingly — not treat each Patch Day as a one-off event.
