By Hamza Faisal
SAP has patched four vulnerabilities rated the maximum 10.0 on the CVSS severity scale, including two that allow an unauthenticated attacker to run code on enterprise systems, as part of its November Security Patch Day on Tuesday.
The release includes 35 new security notes and four GitHub security advisories, plus updates to three earlier notes. SAP publishes its security corrections on the second Tuesday of each month and says customers should treat this month's fixes as a priority.
Three of the four maximum-severity flaws sit in the SAP NetWeaver application server, the software that underpins SAP's business systems, and the fourth affects the Web Dispatcher, which receives web requests from the internet and passes them to that server.
Two flaws allow remote code execution
The most serious pair, dubbed ICM2SHELL by the researchers who found it, affects the way the SAP Kernel handles WebSocket traffic. The memory corruption flaw hits both the Internet Communication Manager, tracked as CVE-2026-76964, and the SAP Web Dispatcher, tracked as CVE-2026-89126. Because the vulnerable code is shared, both components are affected, including the Web Dispatcher embedded in SAP HANA.
An attacker who can reach the software over the network could exploit either flaw to run code without logging in and without any action from a user. Onapsis Research Labs, which discovered the issue and reported it to SAP, said it had not observed active exploitation in the wild as of publication. The flaws affect systems running SAP Kernel 7.40 or higher. NetWeaver AS Java is not affected, though dual-stack installations are vulnerable through their ABAP stack.
Sign-in and server impersonation flaws
The third maximum-severity flaw, CVE-2026-120017, is a missing authentication issue in the SAML 2.0 service provider used by NetWeaver AS ABAP and the ABAP Platform. On systems that use SAML single sign-on, it could allow an attacker to log in as any user. The fourth, CVE-2026-89103, is a broken access control flaw in SAP Gateway, which connects the server to other SAP systems and programs, and could let an attacker impersonate one of the system's own servers and take unauthorised actions.
SAP also fixed a near-maximum flaw rated 9.9, CVE-2026-109803, a code injection vulnerability in NetWeaver Knowledge Management's XML Forms. None of the four 10.0-rated flaws appeared in CISA's Known Exploited Vulnerabilities catalog when checked on November 9, but that does not mean they will stay unexploited.
Patch now, especially internet-facing systems
Organisations running SAP ERP or S/4HANA should treat the four 10.0 notes as their first patching priority, particularly where the Web Dispatcher, Internet Communication Manager or Gateway is internet-facing, or where SAML single sign-on is enabled. Each flaw is fixed in its own SAP security note, and the affected versions differ by component, so administrators need to check the applicable note against their exact kernel and release combination.
For systems that cannot be patched immediately, SAP has published a workaround note for the ICM2SHELL flaws. Security researchers warn that NetWeaver components exposed to the internet have repeatedly drawn attacker attention, so the window between a patch release and exploitation attempts is often short.
