# SAP Security Patch Day, November 2026: detection pack

Nine SAP Security Notes released on 10 Nov 2026 that SAP, as CNA, rates CVSS 3.1 9.0 or above ("Critical" in SAP's
own records). Four are scored 10.0 and need no account.

> **Status of this pack.** The KQL in `kql/` and the converted Sigma in `sigma/converted/` have NOT been run against a
> live Sentinel or Defender tenant. Test and tune them before you rely on them. SAP has published no indicators of
> compromise and no exploit details. Every hunting pattern here is our own. Items we could not confirm are marked
> [UNVERIFIED]. Details that only appear inside SAP Notes are marked [UNVERIFIED - SAP Note requires login].

## Exploitation and KEV status

* **Exploitation:** none of the primary sources checked says any of these flaws is exploited. The official
  November 2026 bulletin, and the cve.org and NVD records, carry no exploitation statement. Do not describe
  them as exploited.
* **CISA KEV:** none of the nine CVEs is in the KEV catalogue (KEV JSON catalogVersion 2026.11.10, released
  2026-11-10T19:03:29.8375Z; rechecked 10 Nov 2026 at 22:27 GMT). Earlier the same day we had also checked
  catalogue 2026.11.09 (released 2026-11-09 19:54 UTC).
* **SAP bulletin:** the official November 2026 Security Patch Day bulletin is now published at
  https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
  (it returned HTTP 404 at 02:30 GMT on 10 Nov 2026 when this pack was first written). On 10 November 2026
  SAP released 35 new security notes and 4 GitHub security advisories, plus 3 updates to previously released
  notes. This pack still covers the nine notes that SAP, as CNA, rates CVSS 3.1 9.0 or above, including the
  four scored 10.0. The product and version strings in the table below match the official bulletin.
* Patch now. Do not wait for a KEV listing.

## Facts (primary sources, checked 10 Nov 2026; official bulletin rechecked late 10 Nov 2026)

All nine scores are CVSS 3.1 base scores set by SAP as CNA (cna@sap.com). NVD status is "Received"; NVD has not
scored any of them. cve.org publication times are 00:17 to 00:43 UTC on 10 Nov; NVD lists them as published at 01:17 UTC.

| CVE | SAP Note | Score | Vector | Account needed? | CWE | Product and affected versions (SAP CNA record) |
|---|---|---|---|---|---|---|
| CVE-2026-120017 | 3849308 | 10.0 | `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` | No. Applies "under certain configurations" | CWE-347 | NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider): SAP_BASIS 702, 731, 740, 750 to 758, 816, 920, 921, 922 |
| CVE-2026-76964 | 3778530 | 10.0 | `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` | No | CWE-1287 | NetWeaver AS ABAP (Internet Communication Manager): KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 |
| CVE-2026-89126 | 3778556 | 10.0 | `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` | No | CWE-122 | Web Dispatcher: HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, KERNEL 7.53, 9.18, 9.20 |
| CVE-2026-89103 | 3798345 | 10.0 | `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` | No. Needs network access to the Gateway | CWE-863 | SAP Gateway (RFC Gateway in the kernel): KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, 8.04, KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.20, 9.21 |
| CVE-2026-76965 | 3792735 | 9.9 | `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` | Yes, low privilege | CWE-749 | NetWeaver AS ABAP and ABAP Platform (OS command execution): KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77, 7.93, 9.16 |
| CVE-2026-109795 | 3834842 | 9.9 | `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` | Yes, low privilege | CWE-94 | S4CRM ("Missing authorization check in S4CRM"): S4CRM 204, 205, 206, S4CEXT 107, 108, 109, BBPCRM 713, 714 |
| CVE-2026-109803 | 3809153 | 9.9 | `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` | Yes, a user with access to the function. "Under certain conditions" | CWE-94 | NetWeaver Knowledge Management (XML Forms): KMC-CM 7.50 |
| CVE-2026-89119 | 3804858 | 9.6 | `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` | No, but a logged on admin must open the attacker's link (CSRF) | CWE-352 | Web Dispatcher and ICM: WEBDISP 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, KERNEL 7.93, 9.20, 9.21 |
| CVE-2026-109798 | 3799117 | 9.1 | `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L` | Yes, authenticated | CWE-611 | BusinessObjects BI Platform (Web Intelligence), OLAP connection requests: ENTERPRISE 430, 2025, 2027 |

What each one does, in SAP's words (summarised):

* **CVE-2026-120017:** insufficient verification of incoming authentication assertions "under certain configurations"
  lets an unauthenticated attacker impersonate any user, including privileged accounts. The record title names the
  SAML2 Service Provider. Which configurations are affected: [UNVERIFIED - SAP Note requires login].
* **CVE-2026-76964:** crafted network traffic triggers memory corruption in the Internet Communication Manager, leading
  to arbitrary code execution and full compromise. No account needed.
* **CVE-2026-89126:** the same class of flaw (heap based buffer overflow) in Web Dispatcher, including the Web
  Dispatcher shipped with HANA (HDB 2.00) and XS Advanced. No account needed.
* **CVE-2026-89103:** the Gateway "activates the default Access Control List with high privileges", so an external
  attacker can be treated as an internal application server and act without authenticating.
* **CVE-2026-76965:** a low privilege user can call internal functionality that lacks authorization checks and run OS
  commands on the host.
* **CVE-2026-109795:** missing authorization check and input validation in remote-enabled functionality lets a low
  privilege user inject and run code.
* **CVE-2026-109803:** an authenticated user with access to KM XML Forms can get an unauthorised XSL transformation
  processed, leading to code execution in the application context.
* **CVE-2026-89119:** cross-site request forgery in admin functions of Web Dispatcher and ICM. An attacker tricks a
  logged on administrator into opening a link; SAP says this can lead to full OS compromise.
* **CVE-2026-109798:** an authenticated attacker can use XXE in OLAP connection requests to read files on the server
  and reach internal systems. High impact on confidentiality, low on integrity and availability. It is not code execution.

Fixed kernel patch levels, support packages and any workarounds are inside the SAP Notes:
[UNVERIFIED - SAP Note requires login]. This pack never guesses version thresholds.

## Patch first (SAP's advice)

SAP's standing advice on its Security Notes page is to apply Patch Day Security Notes "at a priority". Apply the nine
Notes above (`me.sap.com/notes/<number>`, S-user login needed). Kernel Notes (3778530, 3778556, 3798345, 3792735,
3804858) are fixed by kernel or Web Dispatcher patches; check the patch level the Note names.

## Our advice (not from SAP)

1. Start with what is reachable from the internet: Web Dispatcher and ICM (CVE-2026-89126, CVE-2026-76964,
   CVE-2026-89119), then ABAP systems that use SAML2 logon (CVE-2026-120017), then the RFC Gateway (CVE-2026-89103).
2. Make sure the Gateway (33NN, 48NN), message server (36NN, 39NN) and dispatcher (32NN) ports cannot be reached from the
   internet or user networks. Only HTTP(S) through Web Dispatcher should be exposed, and only where needed.
3. Until Note 3798345 is in, do not rely on the Gateway default ACL. Maintain explicit secinfo and reginfo files in
   version 2 syntax without `TP=* HOST=*` permits (SAP Help describes the file format and the restrictive entries).
   Whether explicit files fully mitigate CVE-2026-89103 is [UNVERIFIED - SAP Note requires login].
4. Review SAML2 trust configuration (transaction SAML2) and remove identity providers you do not use. Whether this
   reduces exposure to CVE-2026-120017 is [UNVERIFIED - SAP Note requires login].
5. Ask Web Dispatcher and ICM administrators not to browse other sites in the same browser session as the admin UI
   until Note 3804858 is applied (CSRF).
6. Review who has low privilege accounts and RFC access on CRM, KM and BusinessObjects systems (CVE-2026-76965,
   CVE-2026-109795, CVE-2026-109803, CVE-2026-109798).
7. Hunt with the queries below on every system that was exposed. If you find unexplained privileged logons, new users,
   SAP_ALL assignments, unknown Gateway registrations or SAP processes starting shells: isolate the system, keep the
   logs (Security Audit Log, dev_* traces, gateway log), and rotate privileged and RFC user credentials.

## Contents

| Path | What it is |
|---|---|
| `kql/sap-patchday-2026-11-hunting.kql` | 18 hunts: Q1 to Q1d inventory and exposure (DeviceProcessEvents, DeviceNetworkEvents, DeviceInfo IsInternetFacing, CommonSecurityLog); Q2, Q2b privileged and standard user logons; Q3 to Q3c new users and SAP_ALL or SAP_NEW assignments; Q4, Q4b RFC and Gateway activity; Q5, Q5b SAP processes starting shells (Linux, Windows); Q6 to Q6c crash and restart bursts; Q7, Q7b suspicious file writes and Gateway ACL or profile changes |
| `sigma/*.yml` | 4 rules: shell from SAP kernel process (Linux), command interpreter from SAP kernel process (Windows), Gateway ACL file change (Linux), SAP kernel process writing scripts or persistence files (Linux) |
| `sigma/converted/` | Kusto output for no pipeline, microsoft_xdr, microsoft_365_defender, sentinel_asim and azure_monitor |
| `scripts/check-sap.sh`, `scripts/Check-SAP.ps1` | Read-only offline checkers with identical output and exit codes |
| `tests/` | Bash tests, Pester tests (including a bash vs PowerShell parity check on every case), synthetic fixtures, `run_all.sh` |

### KQL notes

* ABAPAuditLog, ABAPUserDetails, ABAPChangeDocsLog and their columns are confirmed from the Microsoft Learn table
  reference for the agentless Microsoft Sentinel solution for SAP applications. Older containerised agent deployments
  use different `_CL` tables; Microsoft recommends querying through the solution's functions where possible.
* Security Audit Log message IDs AUB (authorization changes) and AUD (user master record changes) are confirmed on
  Microsoft Learn. AU1, AU5, AU6, AU7, AUK and AUL are [UNVERIFIED]; check them in RSAU_CONFIG.
* ABAPChangeDocsLog table names UST04 and AGR_USERS (Q3c) and the Syslog layout of gateway logs (Q4b) are [UNVERIFIED].
* Ports are SAP's usual defaults (NN is the instance number). Adjust to your landscape.

### Sigma conversion (sigma-cli, pySigma Kusto backend)

`sigma check`: 0 errors, 0 condition errors, 0 issues.

* All 4 rules convert on every pipeline tried. `microsoft_xdr` and `microsoft_365_defender` map them to
  `DeviceProcessEvents` and `DeviceFileEvents`; `sentinel_asim` maps them to `imProcessCreate` and `imFileEvent`.
* Caveat: `azure_monitor` maps them to `SecurityEvent`, a Windows table. That output is not usable for the Linux rules,
  and for the Windows rule only if you collect process creation (4688) with command lines.
* Caveat: the Defender pipelines match `Image` and `ParentImage` against `FolderPath` and `InitiatingProcessFolderPath`
  with `endswith`. Check that these columns include the file name in your tenant; KQL Q5, Q5b and Q7 use `FileName`
  and `InitiatingProcessFileName` instead.
* There are no Sigma rules for the SAP application logs: Sigma has no standard log source for the SAP Security Audit Log.
  Use KQL Q2 to Q4 instead.

## Checkers

Strictly read-only. They read only the files you pass, open no network connections, write nothing, run no commands
and send no payloads. They never contact an SAP system. Collect the inputs yourself:

| Option (bash / PowerShell) | Input |
|---|---|
| `--inventory` / `-Inventory` | CSV `sid,host,component,kernel_patch,note,note_applied,internet_exposed`, one row per system and Note. `note_applied` and `internet_exposed` take yes, no or unknown. No commas inside fields. `kernel_patch` is printed for context only |
| `--profile` / `-ProfileFile` | Saved profile parameters, one `name = value` per line. The last value wins |
| `--secinfo` / `-Secinfo` | Saved copy of the Gateway secinfo file |
| `--reginfo` / `-Reginfo` | Saved copy of the Gateway reginfo file |
| `--audit` / `-Audit` | Saved Security Audit Log (SM20 or RSAU_READ_LOG) export as CSV `date,time,client,user,terminal,tcode,program,message_id,text` |

Because the fixed levels are behind the SAP login, the inventory verdict comes from your `note_applied` answer, never
from version numbers. PowerShell also accepts the bash style `--names`.

Verdicts and exit codes (both scripts):

| Exit | Verdict | Meaning |
|---|---|---|
| 0 | PATCHED | Every in-scope row says the Note is applied |
| 1 | VULNERABLE | At least one Note not applied. Unauthenticated flaws on internet exposed systems get a stronger message |
| 2 | UNKNOWN | Applied state unknown or blank, or no inventory given and no findings |
| 3 | NOT IN SCOPE | Only Notes outside the nine covered here |
| 4 | REVIEW | Profile, ACL or audit findings (overrides the inventory verdict) |
| 5 | ERROR | Usage error, unreadable file, wrong CSV header, no rows |

Findings (all our own checks, not SAP indicators of compromise):

* Profile: `gw/acl_mode = 0`; `gw/sim_mode = 1`; `gw/monitor = 2`; `rdisp/msserv_internal` not set. SAP Help gives
  `gw/acl_mode = 1` as the default and documents that without secinfo or reginfo the Gateway behaves as if the
  restrictive internal entries were present. That default ACL is what CVE-2026-89103 concerns, so the checker always
  reminds you to apply Note 3798345.
* secinfo: a permit with `TP=*`, `HOST=*` and no or wildcard `USER-HOST`. reginfo: a permit with `TP=*` and no or
  wildcard `HOST`. Version 1 files are noted as INFO.
* Audit: any event by SAP*, DDIC, EARLYWATCH, SAPCPIC or TMSADM; AUB and AUD events; AU7 [UNVERIFIED message ID];
  SAP_ALL or SAP_NEW in the event text.

Examples:

```
bash scripts/check-sap.sh --inventory inventory.csv --profile DEFAULT.PFL.txt --secinfo secinfo --reginfo reginfo
pwsh -File scripts/Check-SAP.ps1 -Inventory inventory.csv -Audit sm20.csv
```

## Tests

`bash tests/run_all.sh` runs shellcheck, PSScriptAnalyzer, the bash tests, the Pester tests (including bash vs
PowerShell parity on every case), guards against network, write and exec primitives in the scripts, checks that every
fixture is marked FIXTURE_ONLY and uses only RFC 5737 IP addresses, checks for em and en dashes, runs both checkers in a
bwrap sandbox with no network and a read-only filesystem (sha256 of the pack before and after), and runs sigma check
and conversion. It fails hard on any gate. All fixture data is synthetic.

## Sources

* SAP CVE records (SAP as CNA): https://www.cve.org/CVERecord?id=CVE-2026-120017 , CVE-2026-76964, CVE-2026-89126,
  CVE-2026-89103, CVE-2026-76965, CVE-2026-109795, CVE-2026-109803, CVE-2026-89119, CVE-2026-109798
* NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120017 (and the same path for the other eight)
* SAP Security Patch Day and Security Notes and News: https://url.sap/sapsecuritypatchday
* SAP Notes (S-user login): https://me.sap.com/notes/3849308 , 3778530, 3778556, 3798345, 3792735, 3834842, 3809153,
  3804858, 3799117
* CISA KEV catalogue: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
* SAP Help, Gateway security files secinfo and reginfo:
  https://help.sap.com/doc/saphelp_nw75/7.5.5/en-US/e2/16d0427a2440fc8bfc25e786b8e11c/content.htm?no_cache=true
* SAP Help, configuring connections between Gateway and external programs securely (gw/acl_mode default):
  https://help.sap.com/doc/saphelp_nw75/7.5.5/en-US/48/b2096b7895307be10000000a42189b/content.htm?no_cache=true
* Microsoft Learn, Microsoft Sentinel solution for SAP applications log reference and security content:
  https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-solution-log-reference ,
  https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-solution-security-content ,
  https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/abapauditlog
* MITRE ATT&CK: T1190, T1059, T1505.003, T1053.003, T1098.004, T1078