As part of the November Security Patch Day, SAP released fixes for four vulnerabilities, each of which received the maximum score of CVSS 10.0. All four vulnerabilities can be exploited without authentication and without user interaction. Key components of the SAP infrastructure are affected: the SAP NetWeaver AS ABAP application server (Internet Communication Manager, SAML2 provider, SAP Gateway) and SAP Web Dispatcher. Two vulnerabilities are related to memory corruption and can potentially allow arbitrary code execution, one allows attackers to bypass SAML authentication and log in as any user, and another lets attackers gain internal server privileges via SAP Gateway. Patches are available through the SAP November security bulletin, and the vendor recommends applying them as a priority.
Technical details of the vulnerabilities
Memory corruption in ICM and Web Dispatcher (CVE-2026-76964, CVE-2026-89126)
The CVE-2026-76964 and CVE-2026-89126 vulnerabilities share the same root cause: malformed WebSocket control frames with an invalid length field cause a write outside the allocated heap area (heap out-of-bounds write). The attack takes place before any authentication — network access to the vulnerable component is sufficient. According to the analysis, successful exploitation can potentially allow arbitrary code execution and result in full system compromise.
Affected kernel versions for CVE-2026-76964 (ICM): KRNL64UC 7.53; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20. SAP NetWeaver AS Java is not affected.
For CVE-2026-89126 (Web Dispatcher), the scope is broader: in addition to similar kernel versions, standalone and embedded Web Dispatcher instances are affected, including SAP HANA XS Classic and XS Advanced deployments. SAP Content Server is not affected. Full list: HDB 2.00; KRNL64UC 7.53; WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20.
Fixes are delivered via SAP Note 3778530 (ICM) and SAP Note 3778556 (Web Dispatcher).
SAML2 authentication bypass (CVE-2026-120017)
The CVE-2026-120017 vulnerability affects the SAML2 provider in SAP NetWeaver AS ABAP and ABAP Platform. According to researchers, under certain configurations the provider did not validate signatures on incoming SAML assertions. This allows an attacker to forge authentication data and log in to the system as an arbitrary user, including privileged accounts. Full compromise of the system can propagate to connected SAP systems.
Affected SAP_BASIS versions: 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 920, 921, 922. There is no workaround — the only remediation path is described in SAP Note 3849308.
It is worth noting that in June 2026 SAP had already fixed a SAML vulnerability in the same component — CVE-2026-44748 (XML Signature Wrapping), which, however, required a regular account to be present. We have already covered this vulnerability earlier. The new CVE-2026-120017 vulnerability is more dangerous: it does not require any credentials.
Access control violation in SAP Gateway (CVE-2026-89103)
The CVE-2026-89103 vulnerability is related to the behavior of access control lists (ACLs) in SAP Gateway. When the secinfo and reginfo files do not contain explicit rules or rely on the internal host keyword, the gateway applies default rules with high privileges. An external attacker can be classified by the system as one of the internal application servers, which, according to researchers, opens standard attack paths through the Gateway up to and including command execution.
Affected kernel versions: KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.22EXT, 7.53, 8.04; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21. The fix is described in SAP Note 3798345.
Two remediation tracks — not one
Analysis of the affected components shows that the four vulnerabilities fall into two independent remediation tracks. The ICM (CVE-2026-76964) and Web Dispatcher (CVE-2026-89126) vulnerabilities are addressed through a coordinated update of the kernel and all Web Dispatcher instances. According to the RedRays analysis, this update should cover all 17 November fixes for the kernel and Web Dispatcher. However, the SAML2 (CVE-2026-120017) and Gateway (CVE-2026-89103) vulnerabilities require separate adjustments at the AS ABAP level and in the Gateway configuration. Updating only the perimeter Web Dispatcher component does not close all four issues.
There is an additional nuance for CVE-2026-76964: the Web Dispatcher patch can temporarily protect ICM from exploitation via WebSocket, but only if ICM ports are not directly accessible from user networks or the internet. If direct access to ICM ports exists, ICM must also be patched separately.
Practical recommendations
- SAML2 (CVE-2026-120017): All AS ABAP systems using SAML2 for browser-based login (Fiori Launchpad, Web GUI behind an identity provider) should be considered affected until the opposite is confirmed. There is no workaround — SAP Note 3849308 must be applied. After patching, it is recommended to check all trusted identity providers in the SAML2 transaction and analyze audit logs for SAML logins of privileged users from unexpected sources.
- Gateway (CVE-2026-89103): After applying SAP Note 3798345, set the
gw/acl_mode_proxyprofile parameter (for kernels up to 7.77; in kernels from 7.93 it is already present). Make sure thatgw/acl_modeequals 1, that secinfo and reginfo contain explicit rules, and that the Gateway port (33xx) is not accessible from user networks and the internet. - ICM (CVE-2026-76964): Update the kernel via dw.sar or SP Stack Kernel. Disabling WebSocket support blocks the vulnerability but breaks functionality that depends on WebSocket.
- Web Dispatcher (CVE-2026-89126): Inventory all Web Dispatcher instances — standalone, embedded, and those as part of HANA XS. A single missed instance leaves the vulnerability open. For standalone instances — SAPWEBDISP.SAR, for embedded ones — dw.sar or SP Stack Kernel, for HANA XS Classic — SPS08 revision 089.05 or SPS07 revision 079.11, for XS Advanced — version 1.5.4 and higher.
There is no information about these vulnerabilities being exploited in the wild at the time of publication; however, the maximum CVSS score of 10.0, the lack of authentication requirements, and the broad range of affected versions make them a priority for immediate remediation. Organizations using SAP NetWeaver should plan a coordinated kernel and Web Dispatcher update combined with separate fixes for SAML2 and Gateway — and carry it out during the next maintenance window.
