CriticalCVE
SAP Security Patch Day – Critical SAP NetWeaver, Dispatcher and Gateway Vulnerabilities Patched
Cyber Security News·Source published ·1 min read
What happened?
SAP’s November 2026 Security Patch Day brings fixes for critical vulnerabilities across SAP NetWeaver, Web Dispatcher, Gateway, and other business applications. Released on November 10, the update includes 35 new security notes, four GitHub security advisories, and three updates to earlier notes. Four vulnerabilities carry the maximum CVSS score of 10.0, making them the leading priorities for security teams. The release addresses memory corruption, missing authentication, broken access control, and code injection flaws.
Key details
- SAP released 35 new security notes, four GitHub advisories, and three updated notes on November 10.
- Four vulnerabilities received the maximum CVSS score of 10.0 and require no credentials or user interaction.
- CVE-2026-89126 affects Web Dispatcher and multiple kernel, HDB, and runtime components with memory corruption.
- CVE-2026-89103 is a broken access control vulnerability in SAP Gateway covered by Note 3798345.
- CVE-2026-120017 involves missing authentication in the SAML2 Service Provider of NetWeaver AS ABAP.
Affected
- SAP NetWeaver AS ABAP ICM (KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20).
- SAP Web Dispatcher and related kernel, HDB, and runtime components.
- SAP NetWeaver Knowledge Management XML Forms.
- SAP NetWeaver ABAP Application Server.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.