SAP has published 38 new CVE records as part of its November Security Patch Day, including nine critical flaws and four carrying the maximum CVSS score of 10.0. Most of the worst bugs affect SAP NetWeaver, SAP Web Dispatcher and SAP Gateway, and several can be exploited without logging in.

The release, published on Tuesday, 10 November, fixes nine critical, 15 high, 13 medium and one low severity flaw across 34 SAP Notes. SAP has not reported any active exploitation, and none of the 38 flaws has yet appeared in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue. Even so, administrators are being urged to patch internet-facing SAP systems first, because Patch Day releases often draw attacker attention.

Four flaws scored the maximum 10.0

The most serious flaw is CVE-2026-120017, a missing authentication check in the SAML2 service provider of SAP NetWeaver AS ABAP. Under certain configurations, the system fails to verify login assertions, so an attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. It affects SAP NetWeaver AS ABAP and ABAP Platform on SAP_BASIS releases 702 through 920.

The other three CVSS 10.0 flaws are CVE-2026-89126, a memory corruption bug in SAP Web Dispatcher that crafted network traffic can trigger to run code; CVE-2026-89103, a broken access control flaw in SAP Gateway, where a default access control list with high privileges can let an outside attacker pass as an internal application server; and CVE-2026-76964, a memory corruption flaw in the Internet Communication Manager of AS ABAP. Four of this month's critical flaws need no authentication at all.

More critical flaws scored 9.9 and 9.6

Three further bugs score 9.9 and need only low privileges. CVE-2026-76965 allows operating system command injection in the ABAP Application Server, CVE-2026-109795 enables code injection through a remote interface, and CVE-2026-109803 lets an authenticated user abuse XSL transformations in NetWeaver Knowledge Management XML Forms to run arbitrary code. SAP has issued Note 3809153 for that flaw.

CVE-2026-89119, scored 9.6, is a cross-site request forgery flaw in Web Dispatcher and the Internet Communication Manager that could let an attacker trigger admin actions if an administrator clicks a malicious link. CVE-2026-109798, scored 9.1, is an XML external entity bug in BusinessObjects Web Intelligence. Affected components also include SAP BusinessObjects BI Platform, Host Agent, NetWeaver AS Java and S4CRM, with Web Dispatcher and kernel releases 7.53, 7.54, 7.77, 7.93 and 9.16 to 9.20 among those affected. Each SAP Note lists the exact support packages covered.

What administrators should do now

Customers should review the SAP Security Notes for November 2026 and apply the fixes, starting with the four CVSS 10.0 issues on systems reachable from the internet, followed by the low-privilege code execution bugs. Where a patch cannot be applied immediately, network access to SAP Gateway, Web Dispatcher and ICM ports should be limited, and SAML2 settings on ABAP systems should be reviewed.

SAP systems run finance, payroll and supply chains for large companies, so a single takeover can expose a firm's most sensitive data. CISA's catalogue already lists 14 older SAP flaws that attackers have exploited in the past, which is why security teams treat Patch Day as a priority even when no exploitation of the new flaws has been confirmed.