EN PT-BR
← Voltar ao feed
critical

SAP November 2026 Patch Day fixes nine Critical flaws, including unauthenticated CVSS 10.0 bugs in NetWeaver and Web Dispatcher

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 22:56 · coletado há 1 hora

SAP published its November 2026 Security Patch Day bulletin on 10 November 2026, with 38 new CVE records, nine rated Critical and four at CVSS 10.0 (securityonline.info). Most of the worst bugs sit in SAP NetWeaver AS ABAP, SAP Web Dispatcher and SAP Gateway, and several need no authentication. The CNA record for CVE-2026-120017 rates it 10.0 with a network vector, low complexity, no privileges and no user interaction (strix.ai, mirroring the cve.org record). Its main limit is that the SAML2 flaw depends on certain configurations, and no exploitation is confirmed: CVE-2026-89126 is not in CISA KEV and no public exploit is recorded at the time of research (thehackerwire.com). Criticity is critical because several unauthenticated CVSS 10.0 bugs sit in internet-reachable SAP components.

Entenda a falha

A vulnerabilidade

SAP's November 2026 Patch Day fixes nine Critical flaws, four at CVSS 10.0, with several needing no authentication. CVE-2026-120017 (CVSS 10.0) is in the SAML2 Service Provider of SAP NetWeaver AS ABAP and ABAP Platform. Under certain configurations it fails to verify authentication assertions, so an unauthenticated network attacker can impersonate any user, including privileged ones. It affects SAP_BASIS 702 to 920 per the article and up to 922 per CNA data. CVE-2026-89126 (10.0) is memory corruption in SAP Web Dispatcher, reported as code execution by some sources. CVE-2026-76964 is a similar memory corruption in the ICM of AS ABAP. CVE-2026-89103 is a high-privilege default ACL in SAP Gateway. CVE-2026-76965, CVE-2026-109795 and CVE-2026-109803 (9.9) need low privileges. CVE-2026-89119 (9.6) is a CSRF needing an admin click. CVE-2026-109798 (9.1) is an XXE in BusinessObjects Web Intelligence.

Como funciona

In CVE-2026-120017, a login assertion reaches the SAML2 service provider in AS ABAP, which should check that it is genuine before creating a session. In certain configurations the check is not sufficient, so specially crafted data is accepted and the sender is treated as an arbitrary user, including privileged accounts. In CVE-2026-89126, crafted network traffic reaches SAP Web Dispatcher, which does not validate the input enough and corrupts memory. In CVE-2026-89103, SAP Gateway ships with a default access control list carrying high privileges, so an outside party can be treated as an internal application server.

Por que é vulnerável

For CVE-2026-120017 the root cause is insufficient verification of authentication assertions, classified as CWE-347 (improper verification of a cryptographic signature), and it appears only under certain configurations. For CVE-2026-89126 it is insufficient validation of network input leading to memory corruption, classified as CWE-122 (heap-based buffer overflow). CVE-2026-89103 stems from an insecure default ACL. The articles do not explain why these went unnoticed. The fixes are delivered as SAP Notes; the articles do not detail what each one changes.

Onde está

No code, file or commit is public; the fixes are SAP Notes, such as 3849308 for CVE-2026-120017 and 3778556 for CVE-2026-89126, and the affected components are the SAML2 Service Provider in AS ABAP and SAP Web Dispatcher.

Como foi descoberta

The articles do not say who found these flaws or how. They became public through SAP's regular Security Patch Day on 10 November 2026, which published 38 new CVE records across 34 SAP Notes. SAP has reported no active attacks, and none of the CVEs is in CISA's KEV catalog.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 23:16.

Detalhes técnicos

  • CVE-2026-120017 (SAML2 Service Provider, SAP NetWeaver AS ABAP and ABAP Platform): the product does not sufficiently verify incoming authentication assertions under certain configurations, so an unauthenticated attacker can impersonate arbitrary users, including privileged accounts (strix.ai). The weakness is classified as CWE-347 (nki.gov.hu).
  • CVE-2026-89126 (SAP Web Dispatcher): insufficient validation of network input causes memory corruption, classified as CWE-122, with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (strix.ai).
  • Per the article (securityonline.info), which the vendor pages opened did not confirm in detail: CVE-2026-76964 is a memory corruption bug in the Internet Communication Manager of AS ABAP; CVE-2026-89103 is a default high-privilege access control list in SAP Gateway that lets an outside attacker pass as an internal application server; CVE-2026-76965 (OS command injection in AS ABAP), CVE-2026-109795 (code injection through a remote interface) and CVE-2026-109803 (XSL transformation abuse in Knowledge Management XML Forms) score 9.9 and need only low privileges; CVE-2026-89119 (CVSS 9.6) is a CSRF flaw in Web Dispatcher and ICM that needs an admin to click a malicious link; CVE-2026-109798 (CVSS 9.1) is an XXE bug in SAP BusinessObjects Web Intelligence.
  • Affected components named in the article: SAP NetWeaver AS ABAP and ABAP Platform (SAML2 flaw), SAP Web Dispatcher and kernel releases 7.53, 7.54, 7.77, 7.93 and 9.16 to 9.20, SAP Gateway on kernel 7.22 through 9.21, and the SAP BusinessObjects BI Platform, Host Agent, NetWeaver AS Java and S4CRM components (securityonline.info).

Remediação

  • Apply the November 2026 SAP Security Notes, checking each note for its exact affected support packages (securityonline.info). The CNA-linked notes for the two headline flaws are SAP Note 3849308 for CVE-2026-120017 (nki.gov.hu) and SAP Note 3778556 for CVE-2026-89126 (thehackerwire.com).
  • Patch the four CVSS 10.0 issues first on systems reachable from the internet, then the 9.9 low-privilege code execution bugs (securityonline.info).
  • Where a patch cannot be applied at once, restrict network access to the SAP Gateway, Web Dispatcher and ICM ports, and review the SAML2 settings on ABAP systems (securityonline.info).
  • The research did not open SAP's own November 2026 bulletin page, so the list of notes and versions is taken from third-party pages. SAP fixes are distributed as SAP Notes, and no public pull request was found, so no Fix Details section is given.

Relatos divergentes

  • The article gives SAP_BASIS 702 through 920 for CVE-2026-120017 (securityonline.info). The CNA-based records list builds up to SAP_BASIS 922 (strix.ai; radar.offseq.com). The CNA data is the more authoritative source here.
  • The article says CVE-2026-89126 leads to code execution (securityonline.info). The CNA text describes unauthenticated memory corruption without stating code execution (strix.ai), while thehackerwire.com describes it as unauthenticated remote code execution. Treat it as likely RCE until SAP's note has been reviewed.

Linha do tempo

  1. securityonline.info ↗ · pub. 09/11/2026 22:56 · coletado 09/11 23:00 primeiro registro

    SAP November 2026 Patch Day fixes nine Critical flaws, including unauthenticated CVSS 10.0 bugs in NetWeaver and Web Dispatcher

    ler a análise desta fonte

    SAP published its November 2026 Security Patch Day bulletin on 10 November 2026, with 38 new CVE records, nine rated Critical and four at CVSS 10.0 (securityonline.info). Most of the worst bugs sit in SAP NetWeaver AS ABAP, SAP Web Dispatcher and SAP Gateway, and several need no authentication. The CNA record for CVE-2026-120017 rates it 10.0 with a network vector, low complexity, no privileges and no user interaction (strix.ai, mirroring the cve.org record). Its main limit is that the SAML2 flaw depends on certain configurations, and no exploitation is confirmed: CVE-2026-89126 is not in CISA KEV and no public exploit is recorded at the time of research (thehackerwire.com). Criticity is critical because several unauthenticated CVSS 10.0 bugs sit in internet-reachable SAP components.

    Technical Details

    • CVE-2026-120017 (SAML2 Service Provider, SAP NetWeaver AS ABAP and ABAP Platform): the product does not sufficiently verify incoming authentication assertions under certain configurations, so an unauthenticated attacker can impersonate arbitrary users, including privileged accounts (strix.ai). The weakness is classified as CWE-347 (nki.gov.hu).
    • CVE-2026-89126 (SAP Web Dispatcher): insufficient validation of network input causes memory corruption, classified as CWE-122, with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (strix.ai).
    • Per the article (securityonline.info), which the vendor pages opened did not confirm in detail: CVE-2026-76964 is a memory corruption bug in the Internet Communication Manager of AS ABAP; CVE-2026-89103 is a default high-privilege access control list in SAP Gateway that lets an outside attacker pass as an internal application server; CVE-2026-76965 (OS command injection in AS ABAP), CVE-2026-109795 (code injection through a remote interface) and CVE-2026-109803 (XSL transformation abuse in Knowledge Management XML Forms) score 9.9 and need only low privileges; CVE-2026-89119 (CVSS 9.6) is a CSRF flaw in Web Dispatcher and ICM that needs an admin to click a malicious link; CVE-2026-109798 (CVSS 9.1) is an XXE bug in SAP BusinessObjects Web Intelligence.
    • Affected components named in the article: SAP NetWeaver AS ABAP and ABAP Platform (SAML2 flaw), SAP Web Dispatcher and kernel releases 7.53, 7.54, 7.77, 7.93 and 9.16 to 9.20, SAP Gateway on kernel 7.22 through 9.21, and the SAP BusinessObjects BI Platform, Host Agent, NetWeaver AS Java and S4CRM components (securityonline.info).

    Remediation

    • Apply the November 2026 SAP Security Notes, checking each note for its exact affected support packages (securityonline.info). The CNA-linked notes for the two headline flaws are SAP Note 3849308 for CVE-2026-120017 (nki.gov.hu) and SAP Note 3778556 for CVE-2026-89126 (thehackerwire.com).
    • Patch the four CVSS 10.0 issues first on systems reachable from the internet, then the 9.9 low-privilege code execution bugs (securityonline.info).
    • Where a patch cannot be applied at once, restrict network access to the SAP Gateway, Web Dispatcher and ICM ports, and review the SAML2 settings on ABAP systems (securityonline.info).
    • The research did not open SAP's own November 2026 bulletin page, so the list of notes and versions is taken from third-party pages. SAP fixes are distributed as SAP Notes, and no public pull request was found, so no Fix Details section is given.

    Conflicting Reports

    • The article gives SAP_BASIS 702 through 920 for CVE-2026-120017 (securityonline.info). The CNA-based records list builds up to SAP_BASIS 922 (strix.ai; radar.offseq.com). The CNA data is the more authoritative source here.
    • The article says CVE-2026-89126 leads to code execution (securityonline.info). The CNA text describes unauthenticated memory corruption without stating code execution (strix.ai), while thehackerwire.com describes it as unauthenticated remote code execution. Treat it as likely RCE until SAP's note has been reviewed.