SAP Patches Four Vulnerabilities With CVSS 10.0
On November 10, 2026, SAP released patches for four vulnerabilities with the maximum CVSS score of 10.0 in NetWeaver, Web Dispatcher, and Gateway products.
SAP patches for four vulnerabilities with a CVSS score of 10.0 were released by the vendor on November 10, 2026, as part of Security Patch Day. SAP published 35 new security notes and four advisories on GitHub. The vendor recommends prioritizing deployment of the relevant patches.
SAP Patches for NetWeaver, Web Dispatcher, and Gateway
The following flaws received the maximum CVSS rating of 10.0:
- CVE-2026-76964 in the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP, which SAP classifies as memory corruption.
- CVE-2026-89126 in SAP Web Dispatcher, also classified as memory corruption.
- CVE-2026-89103 in SAP Gateway, classified as broken access control.
- CVE-2026-120017 in the SAML2 Service Provider of SAP NetWeaver AS ABAP and ABAP Platform, classified as missing authentication.
SAP published a separate Security Note for each of these vulnerabilities. Detailed technical exploitation conditions and the complete list of fixed patch levels are available in the SAP for Me notes, which require login.
Possible Consequences and Patching Priority
According to secondary reporting, CVE-2026-76964 and CVE-2026-89126 could lead to remote code execution. CVE-2026-89103 is also described in these reports as a flaw enabling unauthenticated remote code execution. SAP lists insufficient access control as its category.
In many environments, the affected components handle network communications or connect SAP systems. Unpatched instances, especially those accessible from the internet, could therefore pose a risk of remote system takeover or unauthorized actions. The severity is increased by the combination of the maximum score, a possible unauthenticated attack, and the impact on NetWeaver, Web Dispatcher, and Gateway components.
Administrators should identify deployments of the listed products, compare their versions with the relevant SAP Security Notes, and apply the applicable updates. Externally accessible SAP instances should receive particular priority.
Active Exploitation Has Not Yet Been Confirmed
The sources reviewed do not confirm that any of the four flaws is being actively exploited in the wild.
Further developments may bring statements from SAP, Onapsis, or security authorities regarding possible exploitation. The publication of public proof-of-concepts or detection rules will also be important. Until they become available, the most direct step is to check the relevant systems and promptly deploy the patches released by SAP.
Sources
- SAP Security Patch Day – November 2026 – Primarily confirms the release date, number of new security notes, four CVSS 10.0 CVEs, affected products, vulnerability types, and SAP Note numbers.
- The Hacker News – Corroborates that two memory corruption flaws could lead to remote code execution and describes the possible consequences of the other two flaws.
- BleepingComputer – Corroborates the scope of the November patches, the ICM2SHELL and PROXYGATE names given by Onapsis researchers, and the reported unauthenticated nature of the attacks.
Verified and updated: November 10, 2026 15:26
