CVE-2026-120017, CVE-2026-89126, CVE-2026-76964 and CVE-2026-89103, SAP NetWeaver AS ABAP, Web Dispatcher and Gateway: four unauthenticated network flaws rated CVSS 10.0 in SAP's CVE records of 2026-11-10, published ahead of Patch Day; no exploitation reported
SAP's CVE records list four unauthenticated CVSS 10.0 flaws in Web Dispatcher, ICM, Gateway and the ABAP SAML2 service
Defender actions
- Pull SAP Security Notes 3849308, 3778556, 3778530 and 3798345 as soon as SAP's Patch Day page lists them and apply the kernel or support-package fix each names, starting with systems whose Web Dispatcher, Internet Communication Manager or Gateway ports are reachable from untrusted networks.
Analysis
SAP, acting as CNA, published CVE records on 2026-11-10 for four flaws it scores CVSS 3.1 10.0, each reachable over the network without privileges or user interaction and with changed scope. In the SAML2 service provider of NetWeaver AS ABAP and the ABAP Platform, an unauthenticated attacker could submit crafted data, under certain configurations, to bypass authentication and impersonate arbitrary users, privileged accounts included (CVE-2026-120017, note 3849308) (ENISA EUVD, 2026-11-10). In SAP Web Dispatcher, crafted network traffic triggers a memory corruption that could allow arbitrary code execution and full compromise (CVE-2026-89126, note 3778556) (ENISA EUVD, 2026-11-10), and the Internet Communication Manager of NetWeaver AS ABAP has the same class of flaw (CVE-2026-76964, note 3778530) (ENISA EUVD, 2026-11-10). SAP Gateway activates its default access control list with high privileges, so an external attacker with network access is treated as an internal application server and can perform unauthorized actions (CVE-2026-89103, note 3798345) (ENISA EUVD, 2026-11-10).
The records list SAP_BASIS 702, 731, 740, 750 to 758, 816 and 920 to 922 for the SAML2 flaw (ENISA EUVD, 2026-11-10); kernel and Web Dispatcher builds 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20 for the Web Dispatcher and Internet Communication Manager flaws, the Web Dispatcher record adding HDB 2.00, XS_ADVANCED_RUNTIME 1.00 and SAP_EXTENDED_APP_SERVICES 1 (ENISA EUVD, 2026-11-10; ENISA EUVD, 2026-11-10); and kernel 7.22 to 9.21 for the Gateway flaw (ENISA EUVD, 2026-11-10). Each record points to the SAP Security Note that carries the fix; none names exploitation or a public proof of concept, and ENISA shows an EPSS value of 0.0 for each. An anonymous path to code execution or to impersonating a privileged user on a network-facing SAP component forces the timeline by itself, whether or not anyone exploits it yet.
Cited evidence
An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts.
An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality.
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server.
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.