Events Securing Finance in the Age of AI · Secure.com X ZIG Finance · London, 12 Nov Register now
Published: November 10, 2026 5 min read

SAP NetWeaver Vulnerabilities: Four Perfect 10s, and Not One Needs a Password

SAP NetWeaver vulnerabilities rated CVSS 10.0 let attackers skip the login entirely. See what SAP fixed, who is exposed, and what to patch.

By Secure.com
SAP NetWeaver vulnerabilities attack path: Web Dispatcher, ICM, Gateway and SAML2 entry points into AS ABAP
Summary

SAP NetWeaver Flaws Let Strangers Sign In as Your Admin

Who should care: Any company running SAP ABAP systems, SAP Web Dispatcher, or SAML single sign-on into Fiori.
What could go wrong: An outsider with network access runs code on your ERP or signs in as your admin.
Do this: Patch Web Dispatcher, ICM, and Gateway today. SAML2 right after.
Worth remembering: None of the four are exploited yet. That clock started this morning.

SAP shipped its November fixes today, and four of them hit the maximum CVSS score of 10.0. These SAP NetWeaver vulnerabilities sit in the plumbing every SAP ABAP system runs on. None need a login, a stolen password, or a user click.

What Happened?

SAP’s November Security Patch Day delivered 35 new security notes, four GitHub advisories and three updated notes, according to RedRays. Nine are rated Critical. Four of the SAP NetWeaver vulnerabilities score a perfect 10.0, as The Hacker News reports:

  • CVE-2026-76964 (Note 3778530): malformed WebSocket frames corrupt memory in the Internet Communication Manager before login, opening a path to code execution.
  • CVE-2026-89126 (Note 3778556): the same bug class in SAP Web Dispatcher, which takes traffic straight from the internet. This includes the copies embedded in HANA XS.
  • CVE-2026-89103 (Note 3798345): SAP Gateway falls back to default access rules that trust the system’s own app servers. An outsider can pose as one.
  • CVE-2026-120017 (Note 3849308): The SAML2 service provider skips signature checks in some setups, so an attacker can sign in as anyone, admins included.

Three more Critical flaws score 9.9, but each one needs a low-privileged account first (SecurityOnline has the full list).

Four CVSS 10.0 SAP NetWeaver vulnerabilities patched on SAP Patch Day November 2026

What’s the Impact?

SAP is where finance, payroll, and supply chain data live. Code execution on the web layer or a forged admin session puts it all within reach. SAP reports no exploitation of these SAP NetWeaver vulnerabilities, and none of the four appear in CISA’s KEV catalog. Attackers read patch notes too, though, and SAP bugs have been turned into working attacks within days before.

That’s why reachability should drive the order of work, not the score alone. Our exposure prioritization playbook explains how to rank fixes by what an attacker can actually touch.

SAP NetWeaver vulnerabilities attack path: Web Dispatcher, ICM, Gateway and SAML2 entry points into AS ABAP

Indicators of Compromise

No hashes, IPs, or domains have been published for the SAP NetWeaver vulnerabilities so far (Rescana and Cybersecuritynews confirm the same). The IOC sheet below lists the CVE identifiers, exposed ports, and log behavior worth hunting for.

SAP NetWeaver vulnerabilities IOC and hunting sheet with CVEs, SAP Notes and log signals

How to Protect Against SAP NetWeaver Vulnerabilities

  • Patch the four notes now, starting with any system reachable from the internet. Set clear vulnerability remediation SLAs so a 10.0 never waits for the next change window.
  • Find every Web Dispatcher, standalone and embedded. One forgotten instance keeps the hole open, so improve asset visibility before you call the job done.
  • Turn off WebSocket support as a stopgap if you can’t patch today. It breaks ABAP Push Channels and some Fiori features.
  • Lock down SAP Gateway after the fix: set gw/acl_mode_proxy, keep gw/acl_mode at 1, write explicit secinfo, reginfo and prxyinfo rules, and block port 33xx from user networks.
  • Review every trusted identity provider in transaction SAML2, and audit privileged SAML logons.

Patching Is a Promise. Proving It Is the Job.

Four 10.0s in one release gives you a patch list, but a vulnerability risk scoring framework only tells you so much. The harder question is which of your SAP systems an attacker can reach right now, and whether the fix for these SAP NetWeaver vulnerabilities actually landed.

  • Red AI Teammate attacks your exposed SAP surface under your rules and confirms what an outsider can really reach.
  • Cloud Security AI Teammate finds every Web Dispatcher and open gateway port, including the ones nobody wrote down.
  • SOC AI Teammate hunts for ICM crashes, rogue gateway registrations, and odd SAML logons, and builds the case before anyone gets paged.
  • GRC AI Teammate keeps patch deadlines, risk acceptances, and retest evidence in one audit trail.
  • Every fix gets retested, so the record proves the hole is closed.

Attack. Harden. Prove. Repeat. Your team sets the rules. AI teammates do the work.

FAQs

What SAP NetWeaver vulnerabilities were patched in November 2026?
Four flaws scored CVSS 10.0: CVE-2026-76964 in the Internet Communication Manager, CVE-2026-89126 in SAP Web Dispatcher, CVE-2026-89103 in SAP Gateway, and CVE-2026-120017 in the AS ABAP SAML2 service provider. All four can be exploited over the network without a login or user interaction.
Are any of these flaws being exploited right now?
Not as of November 10, 2026. SAP has not reported exploitation, no public exploit code has surfaced, and none of the four appear in the CISA Known Exploited Vulnerabilities catalog. SAP bugs have been weaponized within days of disclosure before, so treat that as a short window.
Is there a workaround if I cannot patch today?
For the ICM and Web Dispatcher flaws, disabling WebSocket support is a stopgap, though it breaks ABAP Push Channels and some Fiori features. The Gateway and SAML2 flaws have no workaround, so patching is the only fix.
Which SAP systems should I patch first?
Start with anything reachable from the internet: Web Dispatcher instances, including those embedded in HANA XS, then ICM and any Gateway port (33xx) exposed beyond trusted app servers. Patch SAML2 right after.
How do I check whether my SAP stack was targeted?
Look for unexpected WebSocket upgrade requests and crashes in dev_icm or dev_webdisp, unknown hosts registering in SMGW or gw_log, and privileged SAML logons with no matching record at your identity provider. A hit is a reason to investigate, not proof of compromise.

Related reading from Secure.com:

Other News