SAP has fixed a maximum-severity security flaw in its NetWeaver platform that could let an attacker sign in as any user, including a privileged administrator, without a password. The vulnerability, tracked as CVE-2026-120017, carries the highest possible CVSS score of 10.0 and was patched as part of SAP's November Security Patch Day on 10 November 2026.

The flaw sits in the SAML2 service provider of SAP NetWeaver AS ABAP and the ABAP Platform, the component that hands user sign-in over to an external identity provider. SAP says that under certain configurations the service provider does not perform sufficient verification of incoming authentication assertions. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. SAP warns that a successful attack could lead to a full compromise of the system, with the impact potentially extending to connected components.

One of four maximum-severity flaws

CVE-2026-120017 is one of four flaws in this month's release to score the maximum 10.0. SAP published 38 new CVE records on 10 November, covering 35 new security notes, four GitHub security advisories and three updates to earlier notes. Nine of the flaws are rated Critical, alongside 15 High, 13 Medium and one Low severity issue.

The other three maximum-severity flaws are CVE-2026-76964, a memory-corruption flaw in the Internet Communication Manager; CVE-2026-89126, a heap overflow in SAP Web Dispatcher; and CVE-2026-89103, a broken access-control default in SAP Gateway. All four share the same CVSS 3.1 vector, showing they are exploitable over the network, need no authentication and need no user interaction. Three of the four are unauthenticated routes to code execution or identity impersonation.

Which systems are affected

The SAML2 flaw is fixed by SAP Note 3849308 and affects SAP_BASIS releases 702, 731, 740, 750 through 758, 816, 920, 921 and 922. It is classed as CWE-347, improper verification of a cryptographic signature, and SAP has given the note its HotNews priority, the highest urgency rating it assigns.

Systems that use SAML2 for browser logon, such as the Fiori Launchpad or the Web GUI behind an identity provider, should be treated as in scope until they are shown otherwise. There is no workaround for this flaw, so applying the correction instructions or the listed support package is the only fix. Security teams are also advised to review every trusted identity provider in transaction SAML2 and to check audit logs for SAML logons by privileged users from unexpected sources.

No exploitation reported so far

Neither SAP nor the reporting so far has confirmed any exploitation of CVE-2026-120017, and none of the 38 CVEs in this month's release appears in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue. That is reassuring, but it is not a reason to delay: SAP systems run finance, payroll and supply chains for large organisations, so a single takeover can expose a company's most sensitive data, and Patch Day releases routinely draw attacker attention within days.

The detailed SAP Security Notes sit behind the SAP for Me portal and require a customer login, but the public CVE records carry the severity scores, affected versions and note numbers. Administrators should confirm their exact release, kernel and SAP_BASIS combination against Note 3849308 and patch internet-facing systems first. The other three maximum-severity flaws should be patched in the same maintenance window, starting with the Web Dispatcher and gateway components that face the internet.