"On the affected SAML setups, an attacker could use CVE-2026-120017 to log in as privileged users too," the vendor warned — a single sentence that summarizes why SAP's November Security Patch Day demands immediate attention.
The four 10.0-rated flaws and where they reside
SAP released fixes for four vulnerabilities that the vendor rates CVSS 10.0 — the maximum score. Three of the flaws are in the SAP NetWeaver application server and one is in the Web Dispatcher, the component that receives web requests from the internet and passes them on to the server. None of the four require any user action to work, the vendor says.
SAML2 service provider: CVE-2026-120017 and the risk of arbitrary logins
CVE-2026-120017 affects the server's SAML 2.0 service provider, which hands off user sign-in to an identity provider. Under certain configurations, the service provider did not check signatures on incoming assertions, and an attacker could log in as any user on some systems that use SAML single sign-on. The vendor explicitly states that on affected SAML setups the flaw could let an attacker log in as privileged users too; a full compromise could follow and possibly reach connected systems.
SAP's bulletin notes there is no workaround for this problem: "the correction instructions or the listed support package are the only fix." RedRays advises treating any AS ABAP system that uses SAML2 for browser logon — examples it names are Fiori Launchpad or Web GUI behind an identity provider — as in scope until shown otherwise, and recommends reviewing every trusted identity provider in transaction SAML2 and checking audit logs for SAML logons by privileged users from unexpected sources.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleICM and Web Dispatcher memory-corruption flaws: CVE-2026-76964 and CVE-2026-89126
The ICM flaw (CVE-2026-76964) and the Web Dispatcher flaw (CVE-2026-89126) share a root cause: crafted network traffic can corrupt memory. For the ICM, WebSocket control frames with invalid length fields cause a heap out-of-bounds write before any login, and an attacker who succeeds could run code and fully compromise the system. The vendor says SAP NetWeaver AS Java is not affected.
The Web Dispatcher vulnerability affects standalone and embedded Web Dispatchers, including those in SAP HANA XS Classic and XS Advanced, but not SAP Content Server. Turning off WebSocket support blocks the bug as a last resort, the advisory notes, but that action "breaks features that depend on it" — the bulletin specifically calls out ABAP Push Channels and some Fiori features.
The fixes ship by component: SAPWEBDISP.SAR for standalone Web Dispatchers; dw.sar or the SP Stack Kernel for embedded instances; SPS08 revision 089.05 or SPS07 revision 079.11 for HANA XS Classic; and version 1.5.4 or later for XS Advanced. RedRays stresses finding every Web Dispatcher first because "one missed instance leaves the flaw open." It also notes that if users reach the ICM only through a patched Web Dispatcher, that Web Dispatcher can temporarily shield the ICM — but only if nobody can reach the ICM ports directly.
SAP Gateway impersonation: CVE-2026-89103 and ACL fallback behavior
CVE-2026-89103 targets SAP Gateway, which uses access control lists (secinfo and reginfo) to decide which outside programs may connect and which programs it may start. Where those lists hold no explicit rules or rely on the internal host keyword, the gateway falls back to rules that allow the system's own application servers. In that situation an external attacker who can pass as one of those application servers could be treated with the gateway's high privileges and then take unauthorized actions in the application environment.
There is no workaround listed. For kernels up to 7.77 the fix adds the profile parameter gw/acl_mode_proxy to tighten default rules; kernels from 7.93 onward already include it. RedRays advises setting gw/acl_mode_proxy after patching, checking that gw/acl_mode is 1, ensuring secinfo and reginfo hold explicit rules, and confirming the gateway port (33xx) cannot be reached from user networks or the internet.
RedRays' rollout guidance and the vendor's distribution of fixes
RedRays, which reviewed the SAP notes in SAP for Me, advises updating the kernel and all Web Dispatchers in a single rollout, reaching levels that cover all 17 of this month's kernel and Web Dispatcher fixes. Each flaw is fixed in its own SAP Note, and the affected versions differ by component; the notes live in SAP for Me and require sign-in. The vendor "strongly recommends applying them as a priority," the bulletin says.
- SAML2 (CVE-2026-120017): no workaround; apply the correction instructions or listed support package; review trusted identity providers and audit logs.
- SAP Gateway (CVE-2026-89103): apply the fix; set gw/acl_mode_proxy where required and verify ACLs and gateway network exposure.
- ICM (CVE-2026-76964): patch via dw.sar and the SP Stack Kernel; consider disabling WebSocket only as last resort.
- Web Dispatcher (CVE-2026-89126): apply the listed patch paths; locate every Web Dispatcher and consider temporary WebSocket disablement with awareness of feature breakage.
How technologists, enterprises, and adversaries will respond
Technologists and security teams will prioritize a coordinated kernel and Web Dispatcher rollout, search for every Web Dispatcher instance, and audit SAML2 configurations and privileged logons as RedRays recommends. Affected enterprises and operations teams will need to plan downtime or maintenance windows to apply the component-specific patches and to verify that gateway ACL settings and gateway network exposure meet the advised posture. Adversaries, according to the bulletin's technical descriptions, gain the most from any missed Web Dispatcher, reachable ICM ports, or SAML configurations that skip signature checks, since the flaws require no user action and can enable login, impersonation, or remote code execution.
SAP's fixes are available now in individual SAP Notes; administrators should treat the updates as a priority and follow the correction paths the vendor lists in SAP for Me.
