SAP’s November 2026 Security Patch Day put its most serious flaws in the infrastructure that connects systems, processes requests, and authenticates users. Attackers need no credentials to reach the most severe of them.
Exposure depends on network reachability, authentication settings, and the components deployed in each landscape, so a severity score does not set the order of fixes by itself.
The load on security teams is already heavy. SAPinsider research found that 2025 brought more high-impact and critical SAP patches than any earlier year.
Shared SAP Infrastructure Creates Multiple Paths to Compromise
Two flaws rated 10.0, the maximum on the Common Vulnerability Scoring System (CVSS), affect the Internet Communication Manager (ICM) in SAP NetWeaver AS ABAP and SAP Web Dispatcher (CVE-2026-76964 and CVE-2026-89126).
Thomas Fritsch, SAP security researcher at Onapsis, explains that the kernel does not check the size values in certain WebSocket control messages, so crafted traffic can corrupt memory. An unauthenticated attacker could use that to run code and take control of the system.
Onapsis named the pair ICM2SHELL. The two components run the same kernel code, so the weakness reaches both the application server and the Web Dispatcher, which usually handles incoming traffic from outside networks. The same fix is not enough everywhere. The Web Dispatcher also runs inside SAP HANA Extended Application Services.
Layer Seven Security notes that those deployments need their own updates, with version 1.5.4 or higher for the Advanced Model.The third maximum-severity flaw, which Onapsis named PROXYGATE, sits in SAP Gateway (CVE-2026-89103). Its default access control list can treat an outside attacker with network access as an internal application server, which opens sensitive SAP functions to that attacker. After patching, customers must also set a profile parameter that restricts those default access rules. Onapsis had not observed active exploitation as of its November 10 advisory.
Jonathan Stross, SAP security engineer at Pathlock, writes that reachability and authentication settings determine which systems need the earliest maintenance windows. A Web Dispatcher exposed to untrusted networks presents a different risk from an isolated internal system, even when both carry the same severity score. The Gateway and SAML2 flaws have no workaround, so affected systems stay exposed until the SAP correction is installed.
Authentication and Authorization Weaknesses Extend the Risk
The fourth maximum-severity flaw affects how SAP verifies identity. The SAML2 service provider for SAP NetWeaver AS ABAP and ABAP Platform (CVE-2026-120017) accepts logons that a company’s identity system has vouched for.In certain configurations, SAP does not properly check the identity system’s confirmations. An unauthenticated attacker could forge one, impersonate any user, including privileged accounts, and gain complete control of the system.
Three further flaws, each rated 9.9, start from limited access. Low-level privileges are enough to exploit the OS command injection flaw in SAP NetWeaver and ABAP Platform and the S4CRM flaw, and an authenticated user with XML Forms access can exploit the Knowledge Management flaw. Successful exploitation could let any of them run unauthorized code or operating system commands.
The cross-site request forgery flaw (CVE-2026-89119), rated 9.6, affects the administration interface in the Web Dispatcher and ICM and depends on an administrator’s active session. An attacker who persuades a logged-in administrator to visit a malicious link can trigger unauthorized action. Only installations that use the Administration UI with an admin-role user are affected, according to Pathlock. Until the patch goes in, Layer Seven says, disabling the interface or moving admin users to the monitor role lowers the risk.
Stross recommends reviewing, alongside patching, which system accounts and remote-call permissions can reach the vulnerable functions. Layer Seven describes interim steps that shrink that group: removing the unneeded permissions that let users call the file-transfer function remotely, and restricting XML Forms to trusted users.
October’s release showed the same pattern, with ordinary business permissions becoming system-level control through a vulnerable function. A review of assigned permissions shows who can reach a function, and it may not show what a flaw in that function would let them do.
Remediation Takes Configuration, Workarounds, and Dependency Updates
November is one of the most demanding patch releases for SAP security teams this year. SAP’s bulletin lists 35 new Security Notes, four GitHub advisories, and three updates, and nine of the new notes address critical vulnerabilities. Onapsis counts 43 new and updated notes, a record-breaking total by its measure that includes notes released between the October and November Patch Days.
Gert-Jan Koster, SAP security specialist at SecurityBridge, writes that SAP has never released as many notes in a single cycle. He counts 47 notes and advisories, five of them released between Patch Days. Twelve are HotNews, SecurityBridge’s top urgency level, which is four times as many as in October. Five notes need manual steps beyond the patch, 15 offer a workaround, and shared kernel components, he notes, let one update fix several issues at once.
Fixes differ from flaw to flaw. For the ICM flaw, Layer Seven says organizations that cannot patch right away can route traffic through a patched Web Dispatcher or disable WebSocket support, though SAP advises that doing so can significantly affect applications and integrations. The Gateway flaw needs the access control parameter set after the kernel update. SecurityBridge marks the Gateway and S4CRM notes as needing manual steps.
The four GitHub advisories cover SAP Cloud SDK packages and a sandbox project. Pathlock advises identifying affected dependencies and confirming that corrected versions reach production applications. The PHP2Shell flaws, one of two critical notes for SAP Business AI Platform, affect custom applications connected to SAP. Layer Seven explains that they sit in the PHP runtime beneath those applications, so an attacker gets whatever SAP access the application already has.
Some notes need follow-up that a kernel update does not cover, such as migrating existing password files or configuring destination allowlists. A kernel update can resolve several flaws and still leave others open, because configuration settings and application dependencies sit outside it. Each correction needs confirming in the running system before the finding is closed.
What This Means for SAPinsiders
Shared code concentrates exposure and repair. One flaw in a kernel component can reach several systems, and one coordinated update can close several issues. Landscapes built on shared infrastructure carry the exposure and gain the leverage together.
Permissions are only as safe as the functions behind them. Role design cannot show what a permission allows once a function contains a flaw. The authority a limited role reaches depends on the application code behind it.
Installing a patch comes before closing a vulnerability. Parameters, temporary mitigations, and application dependencies sit outside the kernel update for several of these flaws. A system counts as protected when those steps are complete and verified.
This article was first published by SAPinsider.
