-
Non-Product Related Assistance
Request for existing cases, user IDs, Portal navigation support and more
SAP Security Patch Day - November 2026
This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape.
On 10th of November 2026, SAP security patch day saw the release of 35 new security notes and 4 GitHub security advisories. There are 3 updates to previously released security notes.
Note# | Title | Priority | CVSS |
|---|---|---|---|
[CVE-2026-76964] Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager) Product - SAP NetWeaver AS ABAP (Internet Communication Manager) | Critical | ||
[CVE-2026-89126] Memory Corruption vulnerability in SAP Web Dispatcher Product - SAP Web Dispatcher | Critical | ||
[CVE-2026-89103] Broken Access Control in SAP Gateway Product - SAP Gateway | Critical | ||
[CVE-2026-120017] Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) Product - SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) | Critical | ||
[CVE-2026-109803] Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms) Product - SAP NetWeaver Knowledge Management (XML Forms) | Critical | ||
[CVE-2026-76965] OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform Product - SAP NetWeaver and ABAP Platform | Critical | ||
[CVE-2026-109795] Missing authorization check in S4CRM Product - S4CRM | Critical | ||
[CVE-2026-89119] Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager Additional CVE: CVE-2026-120014 Product - SAP Web Dispatcher and Internet Communication Manager | Critical | ||
[CVE-2026-109798] XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Product - SAP BusinessObjects Business Intelligence Platform (Web Intelligence) | Critical | ||
[CVE-2026-76966] Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform Additional CVE: CVE-2026-109796 Product - SAP NetWeaver and ABAP Platform | High | ||
[CVE-2026-120008] Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service) Product - SAP NetWeaver (Internet Graphics Service) | High | ||
[CVE-2026-109800] Memory Corruption vulnerability in SAP Web Dispatcher Product - SAP Web Dispatcher | High | ||
[CVE-2026-109799] Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip)) Library- SAP Cloud SDK for Python | High | ||
[CVE-2026-109793] Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher Product - SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher | High | ||
[CVE-2026-120010] Memory Corruption vulnerability in SAP NetWeaver Application Server (SAP Message Server) Product - SAP NetWeaver Application Server (SAP Message Server) | High | ||
[Multiple CVEs] Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service) Product - SAP NetWeaver (Internet Graphics Service) | High | ||
[CVE-2026-76970] Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform Product - SAP NetWeaver and ABAP Platform | High | ||
[CVE-2026-109804] Information Disclosure in SAP NetWeaver (SAP Message Server) Product - SAP NetWeaver (SAP Message Server) | High | ||
[CVE-2026-89114] Missing Authentication check in SAP NetWeaver AS Java EDM Application Product - SAP NetWeaver AS Java EDM Application | High | ||
[CVE-2026-76973] Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server) Product - SAP NetWeaver and ABAP Platform (SAP Message Server) | High | ||
[CVE-2026-109794] Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher Product - SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher | High | ||
[CVE-2026-120013] Path Traversal in Agent Memory Module of SAP Cloud SDK for Python Library - SAP Cloud SDK for Python | High | ||
[CVE-2026-120012] Information Disclosure vulnerability in SAP Cloud SDK for AI(JavaScript) Library - SAP Cloud SDK for AI(JavaScript) | High | ||
[CVE-2026-120015] Insufficient Input Validation in SAP Host Agent Product - SAP Host Agent | High | ||
[CVE-2026-120009] Code Injection vulnerability in SAP ABAP Developer Tools (AMDP Data Preview) Product - SAP ABAP Developer Tools (AMDP Data Preview) | High | ||
[CVE-2026-109797] Cross-tenant sandbox takeover in SAP/astonish Product - SAP/astonish | High | ||
[CVE-2026-109802] Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server for ABAP Product - SAP NetWeaver Application Server for ABAP | Medium | ||
[CVE-2026-109811] Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) Product - SAP NetWeaver and ABAP Platform (Application Server ABAP) | Medium | ||
[Multiple CVEs] Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit) Product - SAP NetWeaver Application Server Java (NWDI Cockpit) | Medium | ||
[CVE-2026-109805] Weak Cryptography in SAP NetWeaver and ABAP Platform (Application Server ABAP) Product - SAP NetWeaver and ABAP Platform (Application Server ABAP) | Medium | ||
[CVE-2026-120016] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Visual Composer Product - SAP NetWeaver Visual Composer | Medium | ||
[CVE-2026-109810] CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) Product - SAP NetWeaver Application Server Java (Web Dynpro Java) | Medium | ||
[CVE-2026-89125] Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager Product - SAP Web Dispatcher and Internet Communication Manager | Medium | ||
[CVE-2026-89129] Server-Side Request Forgery in SAP NetWeaver AS Java (Web Services) Product - SAP NetWeaver AS Java (Web Services) | Medium | ||
Update to Security Note released on October 2026 Patch Day: [CVE-2026-76976] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) Product - SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) | Medium | ||
[CVE-2026-89128] Broken Access Control in SAP NetWeaver Process Integration (Process Integration Test Tool) Product - Broken Access Control in SAP NetWeaver Process Integration (Process Integration Test Tool) | Medium | ||
[CVE-2026-73635] Denial of service (DoS) in SAP Business Objects Product - SAP Business Objects | Medium | ||
[CVE-2026-89115] Information Disclosure vulnerability in SAP Start Service and SAP Microsoft Management Console Product - SAP Start Service and SAP Microsoft Management Console | Medium | ||
[CVE-2026-89131] Cross Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Enterprise Portal Product - SAP NetWeaver Enterprise Portal | Medium | ||
Update to Security Note released on July 2026 Patch Day: Product - SAP WebClient UI | Medium | ||
Update to Security Note released on April 2022 Patch Day: Product - SAP WebClient UI | Medium | ||
[CVE-2026-109808] Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI) Product - SAP Solution Tools Plug-In (ST-PI) | Low |
To know more about the security researchers and research companies who have contributed for security patches of this month, visit here.
SAP is committed to delivering trustworthy products and cloud services. Secure configuration is essential to ensuring secure operation and data integrity. We have therefore documented security recommendations that are consolidated in this document to help you configure the best security for your SAP portfolio.
Archived blogs from previous years are available here.
If you have any comments or feedback about this post, you can write to secure@sap.com.