SAP says its Security Patch Day on 10 November 2026 released 35 new security notes and 4 GitHub security advisories, plus 3 updates to previously released notes, and strongly recommends customers apply patches on priority. SAP rates four notes Critical with CVSS 10.0: 3778530 (CVE-2026-76964, memory corruption in SAP NetWeaver AS ABAP Internet Communication Manager), 3778556 (CVE-2026-89126, memory corruption in SAP Web Dispatcher), 3798345 (CVE-2026-89103, broken access control in SAP Gateway) and 3849308 (CVE-2026-120017, missing authentication in SAP NetWeaver AS ABAP and ABAP Platform SAML2 Service Provider).

Other Critical notes include 3809153 (CVE-2026-109803, code injection in NetWeaver Knowledge Management XML Forms, 9.9), 3792735 (CVE-2026-76965, OS command injection in ABAP Application Server, 9.9), 3834842 (CVE-2026-109795, missing authorization check in S4CRM, 9.9), 3804858 (CVE-2026-89119 and CVE-2026-120014, CSRF in Web Dispatcher and ICM, 9.6) and 3799117 (CVE-2026-109798, XXE in BusinessObjects BI Platform Web Intelligence, 9.1). SAP's page does not say any of the flaws is exploited. (source: SAP)

According to BleepingComputer, SAP said unauthenticated attackers can exploit the four 10.0 flaws to fully compromise targeted systems remotely, and Onapsis, which reported three of them, tracks CVE-2026-76964 and CVE-2026-89126 as ICM2SHELL and CVE-2026-89103 as PROXYGATE. (source: BleepingComputer)