SAP used its November Security Patch Day on Tuesday, November 10, to fix four vulnerabilities that each carry the maximum CVSS score of 10.0, all of them reachable by an attacker without any login. The monthly release includes 35 new security notes, four GitHub security advisories, and three updates to previously released notes, and SAP strongly recommends that customers apply the corrections on a priority basis.
The four maximum-severity flaws sit in the core of the NetWeaver stack that runs SAP ERP and S/4HANA systems. CVE-2026-76964 is a memory corruption flaw in the Internet Communication Manager of NetWeaver AS ABAP, fixed in Security Note 3778530. CVE-2026-89126 is a memory corruption flaw in SAP Web Dispatcher, the component that receives web requests from the internet and passes them to the application server, fixed in Note 3778556. Reporting on the notes says both flaws involve improper handling of WebSocket control frames, so a specially crafted request could corrupt memory and potentially allow remote code execution.
The other two flaws attack trust rather than memory. CVE-2026-89103, fixed in Note 3798345, is a broken access control flaw in SAP Gateway, which connects an SAP server to other SAP systems and programs. Under certain configurations, an attacker could impersonate one of the system's own trusted servers and perform unauthorized actions. CVE-2026-120017, fixed in Note 3849308, is a missing authentication flaw in the SAML2 service provider in NetWeaver AS ABAP and the ABAP Platform. On systems that use SAML single sign-on, it could allow an unauthenticated attacker to log in as any user, including privileged users.
All four flaws share the same attack profile: network access, low complexity, no privileges required, and no user interaction, with a scope change that can compromise confidentiality, integrity, and availability beyond the vulnerable component itself. That combination is why a perfect score matters here. Web Dispatcher and the Internet Communication Manager are often the most exposed parts of an SAP landscape, Gateway trust relationships reach deep into connected systems, and a SAML bypass goes around the sign-in controls that enterprises rely on to protect everything else.
The four perfect scores are not the whole release. Three more critical flaws score 9.9: CVE-2026-109803, a code injection flaw in NetWeaver Knowledge Management's XML Forms component; CVE-2026-76965, an operating system command injection flaw in the ABAP Application Server; and CVE-2026-109795, a missing authorization check in S4CRM. A cross-site request forgery issue affecting Web Dispatcher and the Internet Communication Manager, tracked as CVE-2026-89119 and CVE-2026-120014, scores 9.6, and CVE-2026-109798, an XML external entity flaw in BusinessObjects Web Intelligence, scores 9.1.
SAP's public bulletin does not report confirmed active exploitation of the four maximum-severity flaws, and a check against CISA's Known Exploited Vulnerabilities catalog, version 2026.11.09, did not list them. That is breathing room, not a reason to wait. Security researchers who reviewed the notes in SAP's support portal advise updating the kernel and all Web Dispatchers in a single coordinated rollout, and SAP Basis teams should start by inventorying every NetWeaver, Web Dispatcher, Gateway, and SAML2 installation, matching each system's release and kernel level against its note, and prioritizing any component that is reachable from the internet or that brokers single sign-on for the estate.
Photo: SAP headquarters Building 1 in Walldorf, Germany, by Vladislav Bezrukov, CC BY 2.0, via Wikimedia Commons.