Four flaws that attackers could exploit without logging in were fixed today as part of SAP’s monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.
Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.
The flaws in the Web Dispatcher and the Internet Communication Manager (ICM), which handles the server’s web traffic, could allow an attacker who can reach the software over the network to run code, the vendor says.
The flaw in the server’s SAML 2.0 service provider, which hands off user sign-in to an identity provider, could allow an attacker to log in as any user on some systems that use SAML single sign-on.
The flaw in SAP Gateway, which connects the server to other SAP systems and programs, could allow an attacker to impersonate one of the system’s own servers and take unauthorized actions.
None of the four require any user action to work.
Affected Versions and SAP Notes
Each flaw is fixed in its own note, and the affected versions differ by component, according to SAP’s November security bulletin. The notes are in SAP for Me, which requires a sign-in, and the vendor strongly recommends applying them as a priority.
| CVE | Component | SAP Note | Affected versions |
|---|---|---|---|
| CVE-2026-76964 | Internet Communication Manager (ICM), SAP NetWeaver AS ABAP | Note 3778530 | KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 |
| CVE-2026-89126 | SAP Web Dispatcher | Note 3778556 | HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 |
| CVE-2026-89103 | SAP Gateway | Note 3798345 | KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21 |
| CVE-2026-120017 | SAML2 service provider, SAP NetWeaver AS ABAP and ABAP Platform | Note 3849308 | SAP_BASIS 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 920, 921, 922 |
What Each Flaw Allows
On the affected SAML setups, an attacker could use CVE-2026-120017 to log in as privileged users too, according to the vendor. A full compromise could follow, possibly reaching connected systems.
A different SAML flaw in the same software, CVE-2026-44748, was fixed on June 9 and needed an attacker with a normal user account.
In the ICM flaw (CVE-2026-76964) and the Web Dispatcher flaw (CVE-2026-89126), crafted network traffic could corrupt memory. An attacker who succeeds could then run code and fully compromise the system.
SAP Gateway uses access control lists to decide which outside programs may connect to it and which programs it may start. In CVE-2026-89103, the gateway enables its default list with high privileges, allowing an external attacker to be treated as one of the system’s own application servers. That attacker could then take unauthorized actions in the application environment.
What to Do
In its Patch Day analysis, RedRays, a company that reviewed the notes in SAP for Me today, advises updating the kernel and all Web Dispatchers in a single rollout. That rollout should reach levels that cover all 17 of this month’s kernel and Web Dispatcher fixes.
The firm’s guidance for each flaw:
- SAML2 (CVE-2026-120017). Under certain configurations, the service provider did not check signatures on incoming assertions. Treat any AS ABAP system that uses SAML2 for browser logon, such as Fiori Launchpad or Web GUI behind an identity provider, as in scope until shown otherwise. There is no workaround, so the correction instructions or the listed support package are the only fix. The firm’s SAML2 analysis also suggests reviewing every trusted identity provider in transaction SAML2 and checking audit logs for SAML logons by privileged users from unexpected sources.
- SAP Gateway (CVE-2026-89103). Where secinfo and reginfo hold no explicit rules, or rely on the internal host keyword, the gateway falls back to rules that allow the system’s own application servers. An attacker who passes as one of them could then reach the usual gateway attack paths toward command execution. The note lists no workaround. For kernels up to 7.77, the fix adds the profile parameter gw/acl_mode_proxy, which tightens the default rules, while kernels from 7.93 on already have it. The firm’s Gateway analysis advises setting it after patching and checking that gw/acl_mode is 1, that secinfo and reginfo hold explicit rules, and that the gateway port (33xx) cannot be reached from user networks or the internet.
- ICM (CVE-2026-76964). WebSocket control frames with invalid length fields cause a heap out-of-bounds write before any login. SAP NetWeaver AS Java is not affected, and the fix ships through dw.sar and the SP Stack Kernel. If users reach the ICM only through a Web Dispatcher, patching that Web Dispatcher to the levels in FAQ note 3778788 shields the ICM for now, according to the firm’s ICM analysis. That holds only if nobody can reach the ICM ports directly. Turning off WebSocket support blocks the bug as a last resort, but it breaks features that depend on it.
- Web Dispatcher (CVE-2026-89126). It has the same root cause as the ICM flaw. It affects standalone and embedded Web Dispatchers, including those in SAP HANA XS Classic and XS Advanced, but not SAP Content Server. The firm’s Web Dispatcher analysis lists the patch paths: SAPWEBDISP.SAR for standalone instances, dw.sar or the SP Stack Kernel for embedded ones, SPS08 revision 089.05 or SPS07 revision 079.11 for HANA XS Classic, and version 1.5.4 or later for XS Advanced. Turning off WebSocket support works until the patch is in, but the note warns that this affects ABAP Push Channels and some Fiori features. Find every Web Dispatcher first, because one missed instance leaves the flaw open.
