On November 10, 2026, SAP released patches addressing four critical vulnerabilities in its NetWeaver application server and Web Dispatcher. These vulnerabilities have been assigned a CVSS score of 10.0, indicating their severity.
The vulnerabilities include CVE-2026-120017, which allows attackers to log in as any user on certain SAML-enabled systems. Additionally, CVE-2026-76964 and CVE-2026-89126 enable remote code execution through crafted network traffic.
Exploitation of these vulnerabilities is confirmed, with no user interaction required for an attacker to exploit them. This increases the urgency for organizations to apply the patches.
SAP strongly recommends that all affected systems be patched immediately to mitigate potential risks. The vulnerabilities affect SAP NetWeaver AS ABAP, SAP Web Dispatcher, and SAP Gateway products.