Key takeaways
- SAP Security Patch Day on 10 November 2026 covers 42 items: 35 new SAP Security Notes, four GitHub advisories and three updates; nine are rated critical.
- The four notes scored CVSS 10.0 - 3778530, 3778556, 3798345 and 3849308 - all carry a vector with no authentication and no user interaction.
- Five of the nine critical notes concern the SAP kernel or SAP Web Dispatcher, so the fix is a kernel replacement rather than an SNOTE correction.
- According to its CVE record, SAP Note 3849308 lets an attacker impersonate any user at SAML2 logon; it is the second critical SAML note for AS ABAP since June 2026.
- Between the October and November Patch Days SAP released two critical notes (9.8) for SAP Business AI Platform, one of them out of band on 28 October.
The November SAP Security Patch Day, released on 10 November 2026, contains 42 items: 35 new SAP Security Notes, four GitHub security advisories and three updates to notes from earlier months. Nine are rated critical, seventeen high, fifteen medium and one low. On Patch Day itself, July, August, September and October each carried four critical items.
Four notes score CVSS 10.0, and all four share one vector: network attack, no account, no user interaction, changed scope, full impact on confidentiality, integrity and availability. In October, each of the three critical SAP Notes required an account. In November, the four highest-rated ones can.
SAP Security Notes November 2026 - all 42 items
Below are all items released on 10 November 2026, in SAP’s own order, highest CVSS first. Critical items are in bold. Identifiers starting with GHSA are GitHub advisories for open-source libraries and have no SAP Note number. We derived the “Attacker needs” column from the CVSS vector in the CVE record maintained by SAP; for notes covering two CVEs, it reflects the higher-rated one.
| Item | CVE | CVSS | Component | Vulnerability | Attacker needs |
|---|---|---|---|---|---|
| 3778530 | CVE-2026-76964 | 10.0 | ICM in AS ABAP | Memory corruption | none |
| 3778556 | CVE-2026-89126 | 10.0 | SAP Web Dispatcher | Memory corruption | none |
| 3798345 | CVE-2026-89103 | 10.0 | SAP Gateway | Broken access control | none |
| 3849308 | CVE-2026-120017 | 10.0 | AS ABAP, SAML2 | Missing authentication | none |
| 3809153 | CVE-2026-109803 | 9.9 | KM XML Forms (Java) | Code injection | low |
| 3792735 | CVE-2026-76965 | 9.9 | AS ABAP | OS command injection | low |
| 3834842 | CVE-2026-109795 | 9.9 | S4CRM | Missing authorisation check | low |
| 3804858 | CVE-2026-89119, CVE-2026-120014 | 9.6 | Web Dispatcher and ICM | CSRF | none + victim click |
| 3799117 | CVE-2026-109798 | 9.1 | BusinessObjects, WebI | XXE | low |
| 3769130 | CVE-2026-76966, CVE-2026-109796 | 8.9 | AS ABAP, RFC | Memory corruption and more | none |
| 3809953 | CVE-2026-120008 | 8.2 | Internet Graphics Service | Memory corruption | none |
| 3803832 | CVE-2026-109800 | 7.7 | SAP Web Dispatcher | Memory corruption | low |
| GHSA-93m8-crj2-v997 | CVE-2026-109799 | 7.5 | SAP Cloud SDK for Python | Identity spoofing | none |
| 3808627 | CVE-2026-109793 | 7.5 | ICM and Web Dispatcher | Denial of service | none |
| 3805570 | CVE-2026-120010 | 7.5 | SAP Message Server | Memory corruption | none |
| 3809934 | CVE-2026-109806, CVE-2026-109807 | 7.5 | Internet Graphics Service | Two DoS flaws | none |
| 3792915 | CVE-2026-76970 | 7.5 | AS ABAP | Memory corruption | none |
| 3808552 | CVE-2026-109804 | 7.5 | SAP Message Server | Information disclosure | none |
| 3810485 | CVE-2026-89114 | 7.5 | AS Java, EDM | Missing authentication | none |
| 3789273 | CVE-2026-76973 | 7.5 | SAP Message Server | Memory corruption | none |
| 3805681 | CVE-2026-109794 | 7.5 | AS ABAP and Web Dispatcher | Denial of service | none |
| GHSA-28c8-457r-4cf6 | CVE-2026-120013 | 7.5 | Cloud SDK for Python, agent memory | Path traversal | none |
| GHSA-8g7j-49xg-8wf3 | CVE-2026-120012 | 7.5 | SAP Cloud SDK for AI (JS) | Credential disclosure | low |
| 3842766 | CVE-2026-120015 | 7.5 | SAP Host Agent | Input validation | low |
| 3833364 | CVE-2026-120009 | 7.2 | ABAP Developer Tools, AMDP | Code injection | high |
| GHSA-93c9-96j8-4vg9 | CVE-2026-109797 | 7.1 | SAP/astonish | Tenant isolation | low |
| 3793716 | CVE-2026-109802 | 6.5 | AS ABAP | Denial of service | low |
| 3805959 | CVE-2026-109811 | 6.5 | AS ABAP | SSRF | low + victim click |
| 3839977 | CVE-2026-109801, CVE-2026-109809 | 6.5 | AS Java, NWDI Cockpit | Two authorisation flaws | low |
| 3786876 | CVE-2026-109805 | 6.4 | AS ABAP, RFC callback | Weak cryptography | high (adjacent) |
| 3806484 | CVE-2026-120016 | 6.1 | Visual Composer | XSS | none + victim click |
| 3797108 | CVE-2026-109810 | 6.1 | Web Dynpro Java | CSS injection | none + victim click |
| 3782056 | CVE-2026-89125 | 6.0 | Web Dispatcher and ICM | Insecure storage | high |
| 3835738 | CVE-2026-89129 | 5.8 | AS Java, Web Services | SSRF | none |
| 3671819 | CVE-2026-76976 | 5.4 | SAP GUI for HTML | XSS, update | low + victim click |
| 3792447 | CVE-2026-89128 | 5.3 | PI Test Tool | Broken access control | none |
| 3803144 | CVE-2026-73635 | 4.4 | BusinessObjects | DoS, Apache Struts | - |
| 3740168 | CVE-2026-89115 | 4.4 | Start Service and MMC | Information disclosure | high (local) |
| 3801587 | CVE-2026-89131 | 4.3 | Enterprise Portal | CSRF | none + victim click |
| 3155685 | CVE-2026-44768 | 4.1 | SAP WebClient UI | CSP misconfiguration, update | low + victim click |
| 3101986 | - | 4.1 | SAP WebClient UI | CSP, update from 2022 | - |
| 3802244 | CVE-2026-109808 | 3.1 | ST-PI | Missing authorisation check | low |
Two items without a prerequisite need a word of explanation. SAP Note 3803144 (BusinessObjects) fixes a flaw in Apache Struts: CVE-2026-73635 was published by the Apache Software Foundation on 15 August 2026 and its record carries no CVSS score - the 4.4 comes from SAP. SAP Note 3101986 is an update to a note from April 2022 with no CVE number.
After the October Patch Day, SAP added two new notes and six updates to its October page. Note 3843368 came out of band on 28 October and was later updated, so SAP counts it in both groups - it has one row below:
| Item | CVE | CVSS | Component | Status |
|---|---|---|---|---|
| 3846599 | CVE-2026-109618, CVE-2026-109619 | 9.8 | PHP in SAP Business AI Platform | new note |
| 3843368 | CVE-2026-111497 | 9.8 | Brotli in SAP Business AI Platform | new 28 Oct, then updated |
| GHSA-4mv3-jxxm-9cx2 | CVE-2026-89111 | 10.0 | SAP Cloud SDK for Python | update |
| 3805589 | CVE-2026-89107 | 9.9 | S/4HANA validation rules | update |
| 3756450 | CVE-2026-44766 | 6.5 | S/4HANA ICMR | update |
| 3703856 | CVE-2026-24309 | 6.4 | AS ABAP | update |
| 3671819 | CVE-2026-76976 | 5.4 | SAP GUI for HTML | update |
SAP Note 3671819 appears in both tables: SAP updated it after the October Patch Day and again on 10 November.
The network edge: SAP Notes 3778530, 3778556 and 3804858
The Internet Communication Manager (ICM) is the kernel component that accepts HTTP traffic for an ABAP application server. SAP Web Dispatcher sits in front of it as the entry point and in many deployments is the only part of an SAP landscape reachable from the internet. In November, both scored 10.0.
SAP Note 3778530 (CVE-2026-76964) covers ICM; SAP Note 3778556 (CVE-2026-89126) covers Web Dispatcher. Their CVE descriptions are almost word for word the same: insufficient validation of network input in an internal component, memory corruption triggered by crafted traffic, and arbitrary code execution by an unauthenticated attacker. Two CVEs, near-identical wording and the same kernel release lines point to shared code - that is our inference, not something SAP has stated.
An attacker who can reach the ICM or Web Dispatcher port needs no password and no phishing to run code on the server that every SAP request passes through. Production systems usually sit behind Web Dispatcher, which forwards traffic to them.
The third critical note in this layer, 3804858 (CVE-2026-89119, CVSS 9.6), is a CSRF flaw in the administrative functions of Web Dispatcher and ICM: a logged-on administrator only has to open a crafted link. The same layer also has high and medium notes 3803832 (7.7), 3808627 (7.5), 3805681 (7.5) and 3782056 (6.0). All of them list kernel or Web Dispatcher versions, so they ship in the same operation - replacing the kernel and Web Dispatcher with the releases named in the notes. SAP HANA systems with XS Advanced are the exception: Note 3778556 also covers HDB 2.00 and XS_ADVANCED_RUNTIME, so there it needs an update on the SAP HANA side.
Logon: SAP Note 3849308 and SAML2
SAP Note 3849308 (CVE-2026-120017, CVSS 10.0) concerns the SAML2 service provider in SAP NetWeaver AS ABAP and ABAP Platform, SAP_BASIS 702 to 922. According to the CVE record, under certain configurations the system does not sufficiently verify incoming authentication assertions. An attacker without an account can impersonate any user, privileged accounts included.
The flaw bypasses logon safeguards: strong passwords, MFA at the identity provider and SAP password policy. If the system accepts a forged assertion, it asks for nothing else. It affects organisations that sign users in to Fiori, SAP GUI for HTML or web services through SAML2 - which describes many single sign-on deployments.
It is not the first case this year. In June 2026, SAP released Note 3746332 (CVE-2026-44748, CVSS 9.9) for an XML Signature Wrapping flaw in SAML authentication in the same component. The difference matters: according to the CVE record, the June attack required an account; the November one does not. Two critical notes in 154 days suggest that SAML logon in AS ABAP is now an actively researched target. Note 3849308 concerns the SAP_BASIS component, so it is deployed differently from the kernel notes - typically via SNOTE or a support package.
RFC and SAP Gateway: SAP Notes 3798345 and 3769130
SAP Gateway - the RFC gateway in the kernel, not SAP Gateway for OData services - handles RFC communication between SAP systems and external programs. Access control relies on lists that define who may register and start programs. SAP Note 3798345 (CVE-2026-89103, CVSS 10.0) describes a situation in which the default access control list is active with high privileges, so an external attacker is treated as an internal application server. The CVE record speaks of an unauthenticated attacker with network access to the Gateway.
For network segmentation, the internet is not the only concern. The Gateway port is usually not exposed externally, but it is often reachable from the internal network - from an employee’s laptop, a non-SAP application server, a supplier’s machine on the VPN. An attacker with a foothold in the corporate network gets a route into SAP without knowing a single SAP password.
The same layer includes 3769130 (CVE-2026-76966, CVSS 8.9, memory corruption in RFC protocol handling, no account), 3786876 (6.4, weak HMAC in RFC callbacks between application servers) and three notes for SAP Message Server: 3805570 and 3789273 (memory corruption, service crash) and 3808552 (information disclosure). Message Server coordinates the application servers of a system, so taking it down hits the whole system, not a single work process.
From an account to the operating system: SAP Notes 3792735, 3834842, 3809153 and 3799117
Four critical notes require an account with low privileges (PR:L), but their impact reaches far beyond what that account is allowed to do.
3792735 (CVE-2026-76965, CVSS 9.9) - a missing authorisation check in an internal AS ABAP function lets an attacker run arbitrary operating system commands on the host. It is a kernel note, so it belongs in the same window as ICM and Web Dispatcher.
3834842 (CVE-2026-109795, CVSS 9.9) - code injection and execution through a remote-enabled function. SAP’s portal lists the product as S4CRM (S4CRM 204-206, S4CEXT 107-109, BBPCRM 713-714), while the CVE record names SAP NetWeaver. Whoever owns the CRM systems should treat this note as theirs.
3809153 (CVE-2026-109803, CVSS 9.9) - Knowledge Management on AS Java (XML Forms) allows an unauthorised XSL transformation to run, leading to code execution.
3799117 (CVE-2026-109798, CVSS 9.1) - XXE in Web Intelligence on SAP BusinessObjects BI Platform when processing OLAP connections: reading files on the server and reaching internal systems.
What ties this group together is the question we raised in October: who has an account today, and what can it do? In a typical organisation, most system users hold low-privilege accounts, alongside technical and supplier accounts. The group also includes 3833364 (7.2, code injection in AMDP Data Preview, high privileges required) and 3842766 (7.5, SAP Host Agent loading a malicious file under a privileged account).
The AI layer: SAP Cloud SDK, SAP/astonish and SAP Business AI Platform
In October, the top-rated item was an advisory for SAP Cloud SDK for Python. In November, the AI and SAP BTP library layer received four more GitHub advisories:
- GHSA-93m8-crj2-v997 (CVE-2026-109799, 7.5) - SAP Cloud SDK for Python did not verify the JWT signature in IASContextProvider, allowing tenant and user spoofing; fixed in 0.63.1,
- GHSA-28c8-457r-4cf6 (CVE-2026-120013, 7.5) - path traversal in the agent memory module of SAP Cloud SDK for Python, exposing another tenant’s secrets; fixed in 0.50.0,
- GHSA-8g7j-49xg-8wf3 (CVE-2026-120012, 7.5) - SAP Cloud SDK for AI for JavaScript could leak credentials in error messages; affects versions up to 2.17.0,
- GHSA-93c9-96j8-4vg9 (CVE-2026-109797, 7.1) - in SAP/astonish, a multi-tenant AI agent platform, an authenticated user could operate on another team’s sandbox containers; fixed in 3.6.0.
Between Patch Days, SAP also released two critical notes for SAP Business AI Platform: 3846599 (PHP flaws allowing code execution) and 3843368 (memory corruption in the Brotli decoder in Node.js), both scored 9.8. Note 3843368 came out of band on 28 October.
Three of the four advisories concern tenant isolation or identity in multi-tenant applications. The fix belongs to the team that maintains the application code on SAP BTP and its dependency file; it never reaches the Basis team’s calendar. A process built around importing notes into ABAP systems will not cover these items.
Java, BusinessObjects and the rest of the list
The remaining items rarely make headlines, though several need no account. SAP Note 3810485 (7.5) is missing authentication in the EDM application on AS Java: an unauthenticated attacker can retrieve business information. Notes 3809953 (8.2) and 3809934 (7.5) concern Internet Graphics Service and let an unauthenticated attacker repeatedly crash its worker process. Notes 3835738 and 3792447 are, respectively, SSRF in AS Java web services and missing access control in the SAP Process Integration test tool - both without an account, both with lower impact.
SAP Note 3803144 shows a different problem. The Apache Struts flaw reached the CVE list on 15 August 2026; SAP listed the BusinessObjects note in its Patch Day overview on 10 November, 87 days later. An organisation that follows only the SAP overview learned about it on 10 November. One with an inventory of the libraries in its systems could have assessed its exposure in August.
Patching order for November
This month, attack prerequisites set the order better than the scores alone. Eighteen of the 42 items can be exploited with no account and no user interaction; four more need no account if a victim clicks a link.
First wave - no account, scored 10.0. Notes 3778530, 3778556 and 3798345 mean a kernel and Web Dispatcher replacement; Note 3849308 is an SAP_BASIS correction. Start with systems whose ICM, Web Dispatcher or Gateway can be reached from outside the SAP segment, and with systems using SAML2 logon.
Second wave - takeover through an account or an administrator’s click. Notes 3792735, 3834842, 3809153 and 3799117 require an account; Note 3804858 requires a click from a logged-on administrator. Until they are in, review who can call remote-enabled functions and Knowledge Management, and ask Web Dispatcher administrators to be careful with links.
Third wave - availability and information disclosure. Notes for Message Server, ICM and AS ABAP with availability impact ship with the kernel from the first wave. Notes 3809953 and 3809934 concern Internet Graphics Service (BC-FES-IGS), which is updated separately from the kernel. GitHub advisories go to the development teams on SAP BTP.
How SecurityBridge shortens the November cycle
Working through 42 items by hand to see which apply to your landscape starts from scratch every month. Patch Management in SecurityBridge replaces that with a list for specific systems: according to the vendor, it identifies missing patches across the SAP landscape, analyses their impact and supports deployment. In November, with seventeen items tied to the kernel and Web Dispatcher, the question becomes which systems run a kernel release covered by the notes.
The second layer is detection. With four 10.0 notes requiring no account, it is worth knowing whether anyone tried to use them before the patch went in. That is the job of the Threat Detection module in SecurityBridge, which detects threats in SAP systems from their security events.
SNOK holds SecurityBridge Poland Premier Partner status, and we run SecurityBridge implementation and support in Polish and in the Polish time zone.
What to do this week
1/ Identify which systems have ICM, Web Dispatcher or Gateway reachable from outside the SAP segment, and schedule the kernel and Web Dispatcher replacement for them in the earliest window - that one operation covers five critical notes. On SAP HANA systems with XS Advanced, add the update from Note 3778556.
2/ Identify which systems sign users in via SAML2 and deploy Note 3849308 there. If Note 3746332 from June is still outstanding, do it in the same step.
3/ Review the SAP Gateway access control lists and check that no system runs on the default list. The review does not replace the kernel from Note 3798345, but it shows who can reach the gateway today.
4/ Pass the four GitHub advisories and the October notes for SAP Business AI Platform to your development teams on SAP BTP.
How many accounts in your system can call the functions behind Notes 3792735 and 3834842 today? The note list will not tell you; a permissions review will, and an SAP penetration test will tell you most completely: we check patch levels, authorisations, configuration, interfaces and RFC connections, with a report, remediation priorities and a retest after the fix.
If the monthly note cycle takes time your team needs for projects, we take over the SAP Security Patch Day cycle - from analysis and impact assessment to deployment and an audit-ready report.
You can check your SAP systems’ readiness for Polish KSC obligations free of charge with KSC-CHECK. The next SAP Security Patch Day falls on Tuesday 8 December 2026. If you would like to talk about your landscape, get in touch.
Sources
- SAP Support Portal, SAP Security Patch Day - November 2026, accessed 10.11.2026
- SAP Support Portal, SAP Security Patch Day - October 2026, items added after 13.10.2026, accessed 10.11.2026
- SAP Support Portal, SAP Security Patch Day - June 2026, SAP Note 3746332, accessed 10.11.2026
- CVE Program, CVE-2026-120017 record and the records of the other 44 CVE numbers on the list, accessed 10.11.2026
- CVE Program, CVE-2026-73635 record (Apache Struts), accessed 10.11.2026
Available on request
SAP Cybersecurity from A to Z. A guide for CIOs, CISOs and SAP teams
A SNOK Press book on SAP security: attack paths, authorisations, AI agents as threat and defence, an in-house red team lab, detection and response, NIS2, GDPR, DORA and ISO 27001 - with ready-made checklists and audit templates.
- AI in SAP cuts both ways: SAP Joule and agents are a new attack surface, while AI already helps defenders - the book says what to deploy now and what to wait for.
- An in-house SAP red team lab step by step: from the first test question, through hardware and model choice, to authorisation and the first exercise cycle.
- Ready-made audit tools: a quarterly CIO and CISO checklist with result cards, rules of engagement and test authorisation templates, a mapping to the SAP Secure Operations Map.
Please check your inbox
We have sent a download link to the address provided. It is valid for 7 days.