2026-11-11
SAP Security Patch Day, November 2026: four CVSS 10.0 flaws. Patch internet-facing Web Dispatcher and ICM first; how to check if you are affected and what to do today
On November 10, 2026 SAP's Security Patch Day released 35 new security notes and 4 GitHub security advisories, and updated 3 earlier notes. SAP's list marks 9 rows Critical. Four are CVSS 10.0: memory corruption in the Internet Communication Manager (ICM) of NetWeaver AS ABAP (CVE-2026-76964) and in SAP Web Dispatcher (CVE-2026-89126), broken access control in SAP Gateway (CVE-2026-89103), and missing authentication in the SAML2 service provider of AS ABAP (CVE-2026-120017). The CVE records describe all four as unauthenticated, over the network, with no user interaction (CVE-2026-120017 under certain configurations). Three are CVSS 9.9 (CVE-2026-109803, CVE-2026-76965, CVE-2026-109795) and require a low-privileged login. SAP's list does not mention exploitation, and none of the CVEs on the page is in CISA's KEV catalog (the November 10, 19:00 UTC version). Of the CISA assessments attached to the CVE records, the four we could see say exploitation: none. SAP Note text requires a login and this site has not read it. This site's conclusion: patch internet-facing Web Dispatcher and ICM first, confirm fixed levels in the SAP Notes, and plan the update including the restart.