Applications, API, and Cloud

SAP patches four CVSS 10.0 flaws: ICM, Web Dispatcher, Gateway, and SAML2 in NetWeaver vulnerable to unauthenticated takeover

On November 10, 2026, SAP released 35 new security notes, four GitHub bulletins, and three updates to prior notes as part of Security Patch Day. Four vulnerabilities received the maximum CVSS score of 10.0. They affect perimeter-facing components through which SAP systems communicate with the outside world.

  • SourceSAP
  • Source publicationNovember 10, 2026
  • TypeThreats and incidents

What happened

Four 10.0-rated notes cover the communications and authentication layers. Two involve memory corruption: CVE-2026-76964 in the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP, and CVE-2026-89126 in SAP Web Dispatcher. The third, CVE-2026-89103, is an access control flaw in SAP Gateway. According to NVD descriptions, the default access control list grants overly broad privileges, allowing an external attacker to be treated as an internal application server.

The fourth, CVE-2026-120017, impacts the SAML2 Service Provider in NetWeaver AS ABAP and ABAP Platform. NVD notes that under specific configurations, the system insufficiently validates incoming authentication assertions. An unauthenticated attacker can then bypass authentication and impersonate any user, including privileged accounts.

The CVSS vectors for all four flaws indicate network-based attacks requiring no privileges and no user interaction. Onapsis, cited by Infosecurity Magazine, observed that the patch volume was double the 2026 average. As of November 10, none of the four vulnerabilities had been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.

Key findings

  • Note 3778530, CVE-2026-76964: Memory corruption in ICM; SAP lists kernel versions 7.53 through 9.20.
  • Note 3778556, CVE-2026-89126: Memory corruption in SAP Web Dispatcher.
  • Note 3798345, CVE-2026-89103: Access control flaw in SAP Gateway, dubbed ProxyGate in the media.
  • Note 3849308, CVE-2026-120017: Authentication bypass in SAML2 Service Provider.
  • Additionally, CVE-2026-109803 (CVSS 9.9): Code injection in NetWeaver Knowledge Management.

Why it matters

SafeWave CommentaryICM, Web Dispatcher, and Gateway are the components positioned closest to the internet, partner networks, and integrations in many enterprise deployments. Exploiting them requires no valid account, yet SAP typically runs core ERP functions across finance, HR, and logistics. While active attacks have not been publicly confirmed, the window between patch disclosure and the first working exploit is often narrow for vulnerabilities of this severity. Action items: identify running kernel versions and determine which ICM, Web Dispatcher, and Gateway instances are reachable from outside the internal network; prioritize deploying the four notes to internet-facing systems; audit where SAML2 authentication is enabled; and restrict network access to Gateway until patches are applied. Vulnerability handling is one of the measures listed in Article 21 of the NIS2 Directive, so it is worth recording decisions and deadlines. More: Applications, API, and Cloud.