Follow us on Google News
NEW DELHI: Global enterprise software major SAP has released emergency security patches to address four critical vulnerabilities assigned the maximum severity score of 10.0 on the Common Vulnerability Scoring System. The severity of the flaws is heightened by the fact that unauthenticated remote threat actors can exploit them across corporate networks without requiring valid user credentials. Two of the reported weaknesses allow remote code execution, enabling attackers to run arbitrary code on targeted servers and potentially take complete control of core operational environments. The fixes form part of SAP’s November 2026 Security Patch Day, which addressed three flaws residing within the SAP NetWeaver Application Server platform and one affecting SAP Web Dispatcher.
Memory Corruption Risks Threaten Core Platforms
The first critical vulnerability, identified as CVE-2026-76964, was uncovered in the Internet Communication Manager of SAP NetWeaver AS ABAP, which manages server web traffic and data exchange. Attackers can exploit this by transmitting specially crafted network packets with malformed length fields in WebSocket control frames. This structural anomaly leads to out-of-bounds memory writes, corrupting the memory space of the host server and enabling arbitrary code execution without credentials.
A closely related vulnerability, logged as CVE-2026-89126, impacts the SAP Web Dispatcher component through a similar underlying memory corruption flaw. By routing malicious network traffic, attackers can induce memory corruption to achieve remote code execution across both standalone and embedded Web Dispatcher deployments. Components deployed in SAP HANA XS Classic and XS Advanced are likewise vulnerable, though the standalone SAP Content Server remains unaffected by this specific defect.
Authentication Bypass and Gateway Spoofing
The third critical flaw, indexed as CVE-2026-120017, impacts the SAML 2.0 service provider functionality in SAP NetWeaver AS ABAP and the underlying ABAP Platform. SAML operates as an enterprise authentication protocol utilized by organizations to implement Single Sign-On across multiple corporate tools. Under certain system configurations, affected platforms fail to properly validate digital signatures on incoming authentication assertions, allowing an attacker to impersonate any legitimate user, including privileged administrator accounts. This impersonation poses a direct threat to sensitive commercial databases, internal web applications, and connected backend systems, particularly across corporate environments relying on external identity providers to access Fiori Launchpad or Web GUI.
The fourth flaw, registered as CVE-2026-89103, exists within SAP Gateway, the bridge connecting SAP servers to outside systems and external applications. Under specific default access control list settings, the gateway grants overly broad permissions. Attackers can leverage these default permissions to masquerade as an authorized application server, conduct unauthorized tasks across the operational environment, and navigate traditional gateway attack paths toward arbitrary command execution.
Immediate Patching and Infrastructure Audits Advised
To mitigate these risks, SAP released individual security notes, including Note 3778530 for CVE-2026-76964, Note 3778556 for CVE-2026-89126, Note 3798345 for CVE-2026-89103, and Note 3849308 for CVE-2026-120017, spanning versions of SAP Kernel, SAP_BASIS, and related modules. Cybersecurity firm RedRays advised affected enterprises to prioritize immediate deployment across all affected instances simultaneously, noting that the release incorporates 17 broader Kernel and Web Dispatcher corrections.
Security experts emphasized that enterprises must complement software patching with rigorous infrastructure reviews. Administrators using SAML2 have been urged to re-examine trusted identity provider setups and conduct comprehensive audits of administrator logins. Furthermore, organizations should explicitly define secinfo and reginfo rules for SAP Gateway while isolating gateway port 33xx from general user segments and the public internet. Although disabling WebSocket support offers an interim safeguard in select environments, experts cautioned that doing so may break critical Fiori features and related operational services. SAP urged immediate remediation, warning that unpatched, network-exposed servers remain vulnerable to compromise.
