I’M UNDER A CYBER ATTACK

Alert

Logo de SAP

Alert 2026-149 Four critical CVSS 10.0 flaws in SAP NetWeaver and Web Dispatcher

Affected product(s): 

ProductAffected versions
SAP NetWeaver AS ABAP (Internet Communication Manager) — CVE-2026-76964KRNL64UC 7.53; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20
SAP Web Dispatcher — CVE-2026-89126HDB 2.00; KRNL64UC 7.53; WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20
SAP Gateway — CVE-2026-89103KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.22EXT, 7.53, 8.04; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21
SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) — CVE-2026-120017SAP_BASIS 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 920, 921, 922

The versions are those listed in the official SAP advisory. There is no single patched version on that page; the fixes are available in notes 3778530, 3778556, 3798345, and 3849308.

Description

Four vulnerabilities with critical severity (CVSS 10.0, critical) have been published in SAP NetWeaver AS ABAP, SAP Web Dispatcher, and SAP Gateway. They are part of the Security Patch Day on Nov 10, 2026, during which the vendor published 35 new notes, 4 GitHub advisories, and 3 updates to previous notes. This advisory focuses on the four CVSS 10.0 vulnerabilities, the only ones in the cycle with the maximum score. None of them require authentication or user interaction.

CVE-2026-76964 (note 3778530) is a memory corruption issue in the Internet Communication Manager of NetWeaver AS ABAP (CWE-1287) that can lead to remote code execution. CVE-2026-89126 (note 3778556) is a flaw of the same type in SAP Web Dispatcher (CWE-122), including the version bundled with HANA XS Classic and XS Advanced. CVE-2026-89103 (note 3798345) is a broken access control issue in SAP Gateway (CWE-863): the default access control list, which has elevated privileges, may classify an external attacker as an internal application server and allow unauthorized actions. CVE-2026-120017 (note 3849308) affects the SAML2 provider in AS ABAP and ABAP Platform (CWE-347): under certain configurations, the authentication assertion is not sufficiently verified, allowing an unauthenticated attacker to impersonate any user, including privileged users, with an impact that may extend to connected systems.

No exploitation or public proof of concept is currently known. EPSS is not yet available for these CVEs.

Mitigation

It is recommended to prioritize applying notes 3778530, 3778556, 3798345, and 3849308, and to coordinate a single rollout of the kernel and all Web Dispatcher instances (standalone, embedded, and HANA XS). Verify the current levels in SAP for Me. Inventory reachable ICM instances, Web Dispatcher instances, Gateway ports (33xx), and AS ABAP systems that use SAML2.

Researchers report temporary measures and details that do not appear on the public Patch Day page; these must be checked against the current SAP notes before being applied:

  • For SAML2 (CVE-2026-120017) and SAP Gateway (CVE-2026-89103), no workaround is expected: patching is required. After the Gateway patch, researchers recommend hardening the ACL (gw/acl_mode, secinfo/reginfo, and, where applicable, gw/acl_mode_proxy) and not exposing port 33xx to user networks or the Internet.
  • For the ICM (CVE-2026-76964), an already patched Web Dispatcher could provide temporary protection only if no one can reach the ICM ports directly; disabling WebSocket support should be considered a last resort.
  • For Web Dispatcher (CVE-2026-89126), disabling WebSocket is a temporary measure and, according to those reports, affects ABAP Push Channels and some Fiori functionality. All instances should be inventoried: a single unpatched instance leaves the vulnerability unaddressed.
  • Researchers indicate that AS Java would not be affected by CVE-2026-76964 and that SAP Content Server would not be affected by CVE-2026-89126; this should be checked against the notes. For CVE-2026-120017, treat AS ABAP systems that use SAML2 for login as in scope until proven otherwise. The official SAP_BASIS list is the one shown in the table; the current note in SAP for Me may include additional branches.

As general measures, review unusual privileged SAML logins, Gateway log entries from hosts that are not the system’s application servers, and the actual kernel level of each instance after the restart. Neither the official advisory nor the CVE record has published any indicators of compromise. The patch closes the flaw; it does not reverse a previous compromise.

Solution

The solution is to apply notes 3778530, 3778556, 3798345, and 3849308 to the affected components (the kernel and ICM, Web Dispatcher including the HANA XS version, Gateway, and the SAP_BASIS component of the SAML2 provider), under a single update plan. Detailed instructions are provided in each note in SAP for Me.

For information on how to update, visit the following link:

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html

Additional information: