SAP’s November 2026 security updates fix 35 vulnerabilities, including four rated maximum severity in NetWeaver, Web Dispatcher and Gateway, BleepingComputer reports.
- CVE-2026-76964 and CVE-2026-120017 in NetWeaver AS ABAP (Internet Communication Manager and SAML2 Service Provider).
- CVE-2026-89103, broken access control in SAP Gateway.
- CVE-2026-89126, memory corruption in SAP Web Dispatcher.
Onapsis, which reported three of them, says the serious ones don’t need an SAP user, a password or a click. I wrote recently about attackers still hunting leftover NetWeaver webshells; this is a new patch set on the same core platform, so don’t wait.
What to do
If you run SAP, apply the November Patch Day notes, especially kernel and Web Dispatcher updates. Plan the window, then get it done.
God Bless, and May the Source Be with You!
