CriticalCVSS 3.1 10.0Not in KEVSAP NetWeaver

Are your SAP systems exposed by the November 2026 Security Patch Day?

SAP published its official November 2026 Security Patch Day bulletin on 10 November: 35 new notes, 4 GitHub advisories and 3 updates, including four CVSS 3.1 10.0 issues. SAP set those scores; NVD has not scored them. There is no reported exploitation, and they are not in CISA KEV. Apply the November Notes first.

SAP scored these CVSS 3.1. NVD has not. No reported exploitation. Not in CISA KEV

All nine scores are CVSS 3.1 set by SAP as the CVE authority. NVD has not scored them (Received as of 10 November 2026). The official November bulletin, and the public CVE and NVD records, do not report exploitation. They were not in CISA's Known Exploited Vulnerabilities catalogue when we rechecked at 22:27 GMT on 10 November 2026 (catalogue 2026.11.10, released at 19:03 UTC). SAP's official bulletin is now published: 35 new notes, 4 GitHub advisories and 3 updates. This guide focuses on the nine notes SAP rates 9.0 or above. SAP's advice is to apply the Notes. Fixed kernel and Support Package levels are only in those Notes (SAP login required), so we do not state fixed versions.

By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 10 November 2026, 22:41 GMT.

Check Exposure How to Hunt

At a Glance

Based on SAP's official November 2026 bulletin, public CVE records and NVD, rechecked on 10 November 2026. Last updated 10 November 2026, 22:41 GMT.

Severity

Four at CVSS 3.1 10.0

Scored by SAP as CNA. NVD has not scored them. Five further critical Notes at 9.9, 9.6 and 9.1.

Status

Not in KEV

No public report of exploitation. Not in CISA KEV catalogue 2026.11.10 (checked 22:27 GMT, 10 November).

Exposure

ABAP, Web Dispatcher, RFC Gateway

Also S4CRM / S4CEXT / BBPCRM, Knowledge Management XML Forms and BusinessObjects Web Intelligence.

Fix

November SAP Notes

SAP's advice is to apply the Notes. Fixed levels are only in the Notes; we do not state versions.

Schedule

SAP lists 10 November 2026 as Security Patch Day on its Security Notes and News page.

10 Nov 00:17 to 00:43 UTC

The CVE records go public on cve.org, each pointing at a Security Note and the Patch Day landing page.

10 Nov

SAP's official November bulletin is published: 35 new security notes, 4 GitHub security advisories and 3 updates to earlier notes. NVD has the CVE records in Received status and has not scored them.

10 Nov 22:27 GMT

No reported exploitation. The nine CVEs in this guide are not in CISA KEV (catalogue 2026.11.10, released at 19:03 UTC). Apply the Notes.

Critical CVE records published 10 November 2026

Scores are SAP's CVSS 3.1 ratings as shown on cve.org and carried into NVD. Descriptions follow the public CVE text only. SAP Notes are linked for identifier only; we have not opened the SAP-login content, and we do not state fixed kernel or Support Package levels.

CVE	CVSS 3.1	Product (public record)	What the public CVE says	SAP Note
CVE-2026-120017	10.0	NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)	Unauthenticated, but only under certain configurations, which SAP's public records do not specify. Insufficient verification of incoming authentication assertions (CWE-347, improper verification of a cryptographic signature) can let an attacker impersonate arbitrary users, including privileged accounts.	3849308
CVE-2026-76964	10.0	NetWeaver AS ABAP (Internet Communication Manager)	Unauthenticated. Memory corruption in ICM can allow remote code execution.	3778530
CVE-2026-89126	10.0	SAP Web Dispatcher (also the copy bundled with HANA and XS Advanced)	Unauthenticated. Memory corruption can allow remote code execution. The public CVE record lists HDB 2.00 and XS Advanced runtime among the affected versions.	3778556
CVE-2026-89103	10.0	RFC Gateway in the kernel (not SAP Gateway / OData)	Unauthenticated, with network access to the RFC Gateway. The default Access Control List is activated with high privileges, which can treat an external attacker as an internal application server. The public CVE product name is 'SAP Gateway'; the affected versions are kernel components.	3798345
CVE-2026-76965	9.9	ABAP Application Server for SAP NetWeaver and ABAP Platform	Needs a low-privilege login. A missing authorisation check can let that user run operating system commands.	3792735
CVE-2026-109795	9.9	S4CRM, S4CEXT and BBPCRM	Needs a low-privilege login. Code injection behind a missing authorisation check in remote-enabled functionality. The public CVE title is 'Missing authorization check in S4CRM'; the affected product list also includes S4CEXT and BBPCRM.	3834842
CVE-2026-109803	9.9	SAP NetWeaver Knowledge Management (XML Forms)	Needs a low-privilege login with access to the function. An unauthorised XSL transformation could lead to code execution in the application context.	3809153
CVE-2026-89119	9.6	SAP Web Dispatcher and Internet Communication Manager	Needs no login, but a logged-on administrator must open a malicious link (CSRF). SAP says this can lead to a full compromise of the underlying operating system.	3804858
CVE-2026-109798	9.1	SAP BusinessObjects BI Platform (Web Intelligence)	Needs a low-privilege login. XXE in OLAP connection requests can be used to read sensitive files and reach otherwise unexposed internal systems. It is not described as code execution.	3799117

What to Do in the Next 24 Hours

Proactive on the left. Reactive on the right. SAP's advice and our advice are labelled separately, for MSPs and businesses that run SAP estates.

Proactive

Apply Notes and reduce exposure

SAP: apply the November Security Patch Day Notes at a priority. Fixed levels are only in the Notes.
Our advice: start with internet-facing Web Dispatcher and ICM, then ABAP systems that use SAML2 logon, then the RFC Gateway.
Our advice: keep Web Dispatcher, ICM and RFC Gateway or Message Server ports (33xx, 36xx, 39xx) off the internet.
Our advice: review RFC Gateway secinfo and reginfo ACLs, and SAML or assertion logon configuration.

Reactive

Hunt and contain

Our advice: review the Security Audit Log (SM20) for unexpected privileged or service-user logons, and for new users or role changes.
Our advice: look in SMGW for unknown external RFC registrations.
Our advice: look for Web Dispatcher or work process crashes and restarts, and for odd OS processes running as <sid>adm.
Our advice: if you find signs of misuse, isolate the system, rotate privileged and RFC credentials, and keep the logs.

Proactive: SAP's Advice, Then Ours

SAP's published advice is to apply the Notes. The later steps are CybaVerse advice and are not a substitute for the Note text.

SAP

Apply the November Notes

SAP's advice is to apply the Security Patch Day Notes at a priority. Use the Note numbers in the table and confirm them in SAP for Me / Security Patch Day. Fixed kernel and Support Package levels, and any workarounds, are only in those Notes (SAP login required). We do not state fixed versions.

Our advice 1

Choose an order, internet-facing first

Start with internet-facing SAP Web Dispatcher and ICM (CVE-2026-89126, CVE-2026-76964, CVE-2026-89119), including the Web Dispatcher bundled with HANA or XS Advanced. Then apply the SAML2 Service Provider note on ABAP systems that use assertion logon (CVE-2026-120017). Then apply the RFC Gateway note (CVE-2026-89103). Then apply the remaining Notes for products you run (CVE-2026-76965, and S4CRM / S4CEXT / BBPCRM, Knowledge Management XML Forms and BusinessObjects Web Intelligence).

Our advice 2

Keep management ports off the internet

Ensure SAP Web Dispatcher, ICM and RFC Gateway or Message Server ports (commonly 33xx, 36xx and 39xx) are not reachable from the internet. Restrict admin interfaces to known jump hosts or a management network.

Our advice 3

Review RFC Gateway ACLs and SAML configuration

Review RFC Gateway secinfo and reginfo Access Control Lists. CVE-2026-89103 is about a high-privilege default ACL on the RFC Gateway in the kernel, not SAP Gateway (OData). Review SAML or assertion logon configuration on ABAP systems. CVE-2026-120017 applies only under certain configurations, which SAP's public records do not specify. Whether a given ACL or SAML change fully mitigates the issue is only in the Notes.

Our advice 4

Inventory every SAP component in scope

List every system that runs NetWeaver AS ABAP or ABAP Platform, Web Dispatcher (standalone or bundled with HANA or XS Advanced), the RFC Gateway, S4CRM / S4CEXT / BBPCRM, Knowledge Management XML Forms, or BusinessObjects Web Intelligence, including systems you host for clients. Record whether each is internet-facing and which Notes still need to be applied. Do not treat a kernel version string as proof a Note is applied.

Free Detection Pack

Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.

Linux and macOS

check-sap.sh

Read-only offline checker. It reads an inventory CSV you build, plus optional profile, secinfo, reginfo and audit exports. It never contacts an SAP system. Because fixed kernel and Support Package levels are only in the Notes, the inventory verdict comes from your note_applied answers, never from version numbers.

bash check-sap.sh --inventory inventory.csv --profile DEFAULT.PFL.txt --secinfo secinfo --reginfo reginfo

# Optional Security Audit Log export
bash check-sap.sh --inventory inventory.csv --audit sm20.csv

Download check-sap.sh

Windows

Check-SAP.ps1

The same checks in PowerShell 7, with identical output and exit codes. It also runs under PowerShell on Linux.

pwsh -File Check-SAP.ps1 -Inventory inventory.csv -Audit sm20.csv

Download Check-SAP.ps1 (.zip)

Hunting queries

KQL and Sigma

18 KQL hunts for Microsoft Sentinel and Defender (Q1 to Q1d inventory and exposure; Q2 and Q2b logons; Q3 to Q3c new users and SAP_ALL or SAP_NEW; Q4 and Q4b RFC and Gateway activity; Q5 and Q5b shells from SAP processes; Q6 to Q6c crash bursts; Q7 and Q7b file writes and Gateway ACL or profile changes). 4 Sigma rules cover shells and file writes from SAP kernel processes and Gateway ACL changes, with Kusto conversions included. None of the KQL has been run against a live tenant yet.

Download KQL (.zip)Download Sigma (.zip)

Verdicts

PATCHEDEvery in-scope inventory row says the Note is applied.
VULNERABLEAt least one Note is not applied. Unauthenticated flaws on internet-exposed systems get a stronger message.
UNKNOWNApplied state unknown or blank, or no inventory given and no findings.
NOT IN SCOPEOnly Notes outside the nine covered here.
REVIEWProfile, ACL or audit findings (overrides the inventory verdict).

Exit codes

Code	Meaning
0	PATCHED
1	VULNERABLE
2	UNKNOWN
3	NOT IN SCOPE
4	REVIEW
5	Usage or read error

Exit 4 overrides the inventory verdict when a profile, ACL or audit pattern hits.

Know the limits

Both checkers are read-only and offline. They only read the files you point them at, send no network traffic, write nothing and contain no exploit payloads.
SAP has published no indicators of compromise. Every hunting pattern is our own and is marked unverified where it rests on assumed log fields or message IDs.
None of the KQL has been run against a live tenant. Fields and message IDs marked UNVERIFIED depend on your connectors and RSAU_CONFIG.
The checkers never infer a patched build from a kernel or Support Package number, because those fixed levels are only in the Notes.
Prefer the hand-written KQL. Some Sigma pipeline conversions map Linux rules to a Windows table, as the pack README explains.

What is in the pack

File	What it does
check-sap.sh	Offline checker for Linux and macOS (bash)
Check-SAP.ps1	The same checker in PowerShell 7
KQL (18 hunts)	Microsoft Sentinel and Defender hunts Q1 to Q7b
Sigma (4 rules)	Linux and Windows process and file rules, plus Kusto conversions
tests/	Fixtures, bash and Pester tests and a sandboxed no-network run
README.md	Verified facts, SAP vs our advice, limits and usage

Download the Full Pack (.zip)README

Reactive: How to Hunt (Our Advice)

No indicators of compromise have been published for these issues. The hunts below are CybaVerse advice. CybaOps can run them across your estate or your clients'.

Hunt 1

Privileged and service-user logons

In the Security Audit Log (SM20), look for unexpected privileged or service-user logons, especially any that do not match usual admin paths or times. CVE-2026-120017 describes unauthenticated impersonation of arbitrary users, including privileged accounts, under certain configurations.

Hunt 2

New users and role changes

In SM20, look for new user records and unexpected role or profile changes, including SAP_ALL or SAP_NEW assignments, around 10 November and the period each system ran without the Notes applied.

Hunt 3

External RFC registrations

In SMGW, look for unknown external RFC registrations. This is most relevant where the RFC Gateway is reachable and the default ACL issue in CVE-2026-89103 may apply.

Hunt 4

Crashes and odd host processes

Look for SAP Web Dispatcher or work process crashes and restarts, and for unexpected operating system processes running as <sid>adm. Memory corruption issues in ICM and Web Dispatcher can show up as instability as well as compromise.

If you find signs of misuse (our advice)

Isolate the affected SAP system and any connected systems that share trusts or RFC destinations.
Rotate privileged and RFC credentials, and review assertion, SAML and service-user secrets.
Keep Security Audit Logs, Gateway traces, Web Dispatcher logs and host process data.
Apply the November Notes on a known-good build, and keep monitoring for further logons and RFC changes.

Applied Notes do not mean the system is clean

Applying the Notes stops new attacks that use those flaws. It does not undo sessions, RFC registrations or host changes already made. Hunt the period before the Notes were applied.

SAP November 2026 Patch Day FAQ

Short answers based on public SAP CVE records and NVD as of 10 November 2026.

What is SAP Security Patch Day for November 2026?

SAP schedules Security Patch Day on the second Tuesday of each month. For 2026 that date is 10 November. SAP's official November bulletin, now published, says that on 10 November 2026 SAP released 35 new security notes and 4 GitHub security advisories, plus 3 updates to previously released notes. SAP, as the CVE numbering authority, also published the CVE records on cve.org between 00:17 and 00:43 UTC on 10 November 2026. NVD received them at 01:17 UTC, in Received status, and has not scored them. The November bulletin page had returned HTTP 404 at 02:30 GMT, before it went live later that day. The SAP Notes need an SAP login; we have not opened them and we do not state fixed kernel or Support Package levels, or any workarounds that exist only in the Notes.

Which issues are rated CVSS 10.0, and who scored them?

Four, all scored by SAP as CNA at CVSS 3.1 10.0 Critical. NVD has not scored them. They are CVE-2026-120017 (SAML2 Service Provider assertion / signature verification, under certain configurations), CVE-2026-76964 (memory corruption in AS ABAP Internet Communication Manager), CVE-2026-89126 (memory corruption in SAP Web Dispatcher, including the copy bundled with HANA and XS Advanced) and CVE-2026-89103 (RFC Gateway in the kernel, not SAP Gateway for OData).

Is exploitation reported, or are they in CISA KEV?

The official November bulletin, and the public CVE and NVD records, do not report exploitation of these November 2026 issues. They were not in CISA's Known Exploited Vulnerabilities catalogue when we rechecked at 22:27 GMT on 10 November 2026 (catalogue version 2026.11.10, released at 19:03 UTC). That can change; recheck KEV and SAP's updates.

What does 'under certain configurations' mean for CVE-2026-120017?

The public CVE text says incoming authentication assertions are not sufficiently verified under certain configurations, and the CWE is CWE-347 (improper verification of a cryptographic signature) in the SAML2 Service Provider. SAP's public records do not say which configurations are affected. That detail, if it exists, is in SAP Note 3849308, which needs an SAP login and which we have not opened.

Which of the other critical issues need a login?

CVE-2026-76965, CVE-2026-109795, CVE-2026-109803 and CVE-2026-109798 need a low-privilege login. CVE-2026-89119 needs no login, but a logged-on administrator must open the attacker's link. The four CVSS 10.0 issues need no login, with the configuration caveat on CVE-2026-120017 and the need for network access to the RFC Gateway on CVE-2026-89103.

What is SAP's official advice?

SAP's published advice is to apply the Security Patch Day Notes at a priority. The Note numbers are in the table. Fixed kernel and Support Package levels, and any workarounds, are only in those Notes (SAP login required), so we do not state fixed versions here.

What is CybaVerse's advice on top of that?

Our advice, not SAP's: apply internet-facing Web Dispatcher and ICM first, then ABAP systems that use SAML2 logon, then the RFC Gateway, then the remaining Notes for products you run. Keep Web Dispatcher, ICM and RFC Gateway or Message Server ports (commonly 33xx, 36xx and 39xx) off the internet. Review RFC Gateway secinfo and reginfo Access Control Lists, and review SAML or assertion logon configuration. These steps reduce exposure; they do not replace the Notes.

How do we hunt for misuse?

Our advice: look for unexpected privileged or service-user logons, new users or role changes in the Security Audit Log (SM20), unknown external RFC registrations in SMGW, Web Dispatcher or work process crashes and restarts, and odd operating system processes running as <sid>adm. If you find any of these, isolate the system, rotate privileged and RFC credentials, and keep the logs.

Who is this relevant to?

MSPs and businesses that run SAP estates, including hosted or managed NetWeaver AS ABAP, Web Dispatcher (standalone or bundled with HANA or XS Advanced), the RFC Gateway, S4CRM / S4CEXT / BBPCRM, Knowledge Management or BusinessObjects Business Intelligence Platform.

Where are the official details?

Start at SAP's official November 2026 Security Patch Day bulletin, the Security Patch Day landing page, and the Note links in the table (an SAP login is required for the Notes). Public CVE text is on cve.org and NVD.

Protect Your SAP Estate, and Your Clients'

CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.

Book a CybaOps demo