For: anyone running SAP ERP or business systems themselves (NetWeaver AS ABAP, S/4HANA, Web Dispatcher and so on), the IT and security staff responsible, and people who leave operations to a contractor. This article is based on SAP's public Security Patch Day list, the CVE records and CISA's KEV catalog. It does not cover attack steps.
Developing: this article will be updated as more is published
- Who is affected
anyone running SAP ERP or business systems themselves (NetWeaver AS ABAP, S/4HANA, Web Dispatcher and so on), the IT and security staff responsible, and people who leave operations to a contractor.
- Confirmed so farSee the table ↓
- Patch day counts
- The four CVSS 10.0 flaws
- The three CVSS 9.9 flaws
- Not yet confirmed
- SAP Note text (fixed versions, patch levels, workarounds; requires a login and this site has not read it)
- Whether any of these is exploited (neither SAP's list nor KEV mentions it; CISA's assessment is attached to 4 of the 7 records)
- Addition to CISA's KEV catalog (not listed in the November 10, 19:00 UTC version)
- What to do nowSee the steps ↓
- List the SAP entry points reachable from outside
- Check your versions
- Open the SAP Notes and confirm the fixed levels
3 more
- Look for gaps with System Recommendations
- Plan the update, including the restart
- Narrow what can reach these systems until then
- Where to verify (source)All sources ↓
- SAP "Security Patch Day - November 2026" (November 10, 2026)
- Last checked
- As of November 11, 2026 (JST)
Follow-up plans and what we checked
SAP's public page says that on November 10, 2026 the Security Patch Day released 35 new security notes and 4 GitHub security advisories, and updated 3 earlier notes. SAP strongly recommends visiting the support portal and applying the patches on priority.
What to do today
List the SAP entry points reachable from outside
Check whether Web Dispatcher (SAP's front-end component that distributes HTTP requests), ICM (the part of AS ABAP that handles HTTP and HTTPS) and SAP Gateway are reachable from the internet or from partner networks, using your firewall rules and the real range of source addresses. Anything reachable is the top priority. Internal-only systems are also in scope, but come later.
Check your versions
In general, the SAP kernel version is shown in SAP GUI under System, Status, in transaction SM51, or on the server with disp+work -version. The SAP_BASIS version is in the component list on the Status screen. Web Dispatcher is generally a separate process with its own version (the above is not in SAP's text; it is our addition). Compare them with the "Version(s)" column in SAP's list. Web Dispatcher embedded in HANA (our reading of the list's "HDB 2.00" entry) or in the XS Advanced runtime is also named in the list (our interpretation).
Open the SAP Notes and confirm the fixed levels
Open the note numbers in the table below on the SAP Support Portal. Fixed versions, required patch levels and any workarounds are in the note text. The same kernel versions appear in several rows, so check in the text whether one kernel update can cover several notes and plan it together.
Look for gaps with System Recommendations
If you use SAP Solution Manager, System Recommendations lists the security notes that apply to each system. In general, if the system data is out of date it may not list a note. Check that the numbers in the table appear as candidates, and if not, refresh the system data and check again (our addition). Without Solution Manager, check the note numbers one by one by hand.
Plan the update, including the restart
A kernel update generally means stopping and starting instances. Test it, then book the downtime window for production in advance. In general, a redundant front end can be updated one node at a time. After the restart, confirm the running kernel version is the new one (the above is not in SAP's text; it is our addition).
Narrow what can reach these systems until then
Close with the firewall any entry point that does not need to be reachable from outside. Keep internal-facing endpoints such as SAP Gateway off the internet and limited to the servers that need them. If you configured SAML 2.0 authentication, you may be affected by CVE-2026-120017, so first check whether it is set up (the CVE record says "under certain configurations").
Web Dispatcher or ICM exposed
Top priority. Reachable without authentication. Book the update window today
Gateway, SAML 2.0 authentication
Next. Limit what can reach them and check whether you use them
The three 9.9 items, exploitable after login
More urgent where many people can log in. Otherwise the normal schedule
Priority table (CVSS 10.0 and 9.9)
The CVSS values are the same in SAP's list and the CVE records (assigned by SAP). The "Precondition" column is based on the description in the CVE record.
| CVE | Product | CVSS | SAP Note | Precondition (CVE record) |
|---|---|---|---|---|
| CVE-2026-89126 | SAP Web Dispatcher (memory corruption) | 10.0 | 3778556 | Unauthenticated; over the network |
| CVE-2026-76964 | ICM of NetWeaver AS ABAP (memory corruption) | 10.0 | 3778530 | Unauthenticated; over the network |
| CVE-2026-89103 | SAP Gateway (access control) | 10.0 | 3798345 | Unauthenticated; needs network access to the Gateway |
| CVE-2026-120017 | SAML2 service provider of AS ABAP and ABAP Platform (missing authentication) | 10.0 | 3849308 | Unauthenticated; under certain configurations |
| CVE-2026-76965 | AS ABAP and ABAP Platform (OS command execution) | 9.9 | 3792735 | Low-privileged login |
| CVE-2026-109795 | S4CRM (missing authorization) | 9.9 | 3834842 | Low-privileged login |
| CVE-2026-109803 | NetWeaver Knowledge Management (XML Forms, code injection) | 9.9 | 3809153 | Authenticated user |
The other two rows SAP marks Critical are:
| CVE | Product | CVSS | SAP Note |
|---|---|---|---|
| CVE-2026-89119 (additional CVE: CVE-2026-120014) | Web Dispatcher and ICM (CSRF) | 9.6 | 3804858 |
| CVE-2026-109798 | SAP BusinessObjects BI (Web Intelligence, XXE) | 9.1 | 3799117 |
This site's view: the four CVSS 10.0 flaws are spread across the front end (Web Dispatcher, ICM), the relay (Gateway) and authentication (SAML2). Protecting one attack surface is not enough for an SAP landscape. Web Dispatcher and ICM also have other notes for memory corruption and denial of service at CVSS 7.5 to 7.7 (CVE-2026-109800, 109793, 109794), so it is worth planning the front-end and kernel updates as one piece of work. Which patch level fixes what is in the note text.
What SAP published
- Counts
- 35 new security notes, 4 GitHub security advisories and 3 updates to earlier notes (SAP's description)
- Priority breakdown
- SAP's list has 42 rows: 9 Critical, 17 High, 15 Medium and 1 Low (this site counted the rows). That includes the 4 GitHub items and the 3 updates
- Critical (9 rows)
- Four at CVSS 10.0, three at 9.9, one at 9.6 and one at 9.1
- Updates to earlier notes
- October 2026 (XSS, note 3671819), July 2026 (WebClient UI, note 3155685) and April 2022 (WebClient UI, note 3101986). If you applied them earlier, check the updated content
- Developer libraries
- The 4 GitHub advisories cover SAP Cloud SDK for Python (before 0.63.1 and before 0.50.0), SAP Cloud SDK for AI (JavaScript, 2.17.0 and earlier) and SAP/astonish (before 3.6.0). Check the package versions you use, separately from the ERP itself
- SAP's recommendation
- Visit the support portal and apply the patches on priority
- CVE-2026-89126, 76964
- Memory corruption. An unauthenticated attacker sending specially crafted network traffic could execute arbitrary code and fully compromise the system. CVSS 3.1 is 10.0 (network, low complexity, no privileges, no user interaction, scope changed)
- CVE-2026-89103
- SAP Gateway activates the default access control list with high privileges, so an external attacker is treated as an internal application server. An unauthenticated attacker could perform unauthorized actions. CVSS 3.1 is 10.0
- CVE-2026-120017
- Under certain configurations, incoming authentication assertions are not sufficiently verified. An unauthenticated attacker could bypass authentication and impersonate arbitrary users, including privileged accounts. CVSS 3.1 is 10.0
- CVE-2026-76965, 109795, 109803
- With a low-privileged login: OS command execution (76965), code injection (109795), and arbitrary code execution through an unauthorized XSL transformation (109803). CVSS 3.1 is 9.9
- Fixed versions and workarounds
- Not in the CVE records. See the SAP Note text
Exploitation status
As of November 11, 2026, this is what we could confirm.
- SAP's list
- No mention of exploitation
- KEV
- None of the 45 CVEs on SAP's list is in CISA's Known Exploited Vulnerabilities catalog (the November 10, 19:00 UTC version)
- CISA assessment (SSVC)
- Attached to four of the records: CVE-2026-89126, 120017, 109803 and 109795. All say exploitation: none. 89126 and 120017 are rated automatable; 109803 and 109795 are not. Technical impact is total for all four. 76964, 89103 and 76965 had no assessment when we checked
This site's view: "no exploitation" is an assessment made less than a day after release. CISA may still add assessments or change them. Start with the entry points that are exposed to the outside before that changes.
What is known and not known
| Item | What has been published | Status |
|---|---|---|
| Patch day counts | 35 new notes, 4 GitHub advisories, 3 updates (SAP) | Confirmed (SAP) |
| The four CVSS 10.0 flaws | Web Dispatcher, ICM, Gateway, SAML2. Products and version ranges (SAP's list, CVE records) | Confirmed (SAP) |
| The three CVSS 9.9 flaws | ABAP, S4CRM, Knowledge Management. A low-privileged login is required (CVE records) | Confirmed (SAP) |
| Fixed versions and patch levels | In the SAP Note text (requires a login) | Not verified |
| Workarounds | Not in the list or the CVE records | Not stated |
| Exploitation | Not in SAP's list or KEV; the four CISA assessments say none | Not stated |
| Addition to KEV | Not in the November 10, 19:00 UTC version | Not stated |
If you leave operations to someone else
Ask your contractor or SAP support contact these three questions.
- What are our SAP kernel and SAP_BASIS versions, and the versions of Web Dispatcher and ICM
- When will the SAP Notes in the table be applied, and in which downtime window with a restart
- Are Web Dispatcher and Gateway reachable from the internet or partner networks, and do we use SAML 2.0 authentication
This site's view: an inventory of versions makes every monthly update faster
SAP patch days come every month, and updates are usually delayed less by the flaw itself than by arranging the downtime window and testing. If you keep a list of which systems are visible from outside and which kernel version each runs, you do not have to start from scratch every patch day. How to set priorities is covered in deciding what to patch first (CVSS, EPSS, KEV).
Timeline
November 10, 2026
SAP holds its Security Patch Day: 35 notes, 4 GitHub advisories and 3 updates. Seven CVE records are published the same day (UTC).November 10 (UTC, evening)
CISA attaches exploitation: none assessments to four of the CVE records. The KEV JSON (19:00 UTC version) does not contain the CVEs on SAP's list.November 11
This site checks SAP's list, the CVE records and KEV, and publishes this article.
Sources (public records)
Checked on November 11, 2026. SAP's own publication is listed first. The SAP Note text requires a login and was not checked.
- SAP "Security Patch Day - November 2026" (November 10, 2026) — support.sap.com
- CVE records (published November 10, 2026; assigned by SAP): CVE-2026-89126 / CVE-2026-76964 / CVE-2026-89103 / CVE-2026-120017 / CVE-2026-76965 / CVE-2026-109795 / CVE-2026-109803
- CISA Known Exploited Vulnerabilities catalog (checked against the November 10, 2026, 19:00 UTC version) — cisa.gov / JSON
Update history
2026-11-11: First version, based on SAP's list, seven CVE records and KEV (the November 10, 19:00 UTC version). No exploitation is reported. The SAP Note text has not been checked.
Read next
- After a disclosure: what to do when a vulnerability is disclosed / deciding what to patch first (CVSS, EPSS, KEV)
- Another multi-fix release: the Jenkins security advisory of October 28, 2026 (15 issues)
- Preparation: the security inventory checklist
- Terms: what a CVE is / what CVSS is