SAP Security Patch Day November 2026: Critical Vulnerabilities

SAP released 38 Security Notes on the November 2026 Patch Day. Nine are Critical, and 13 are High, with the most urgent issues affecting SAP NetWeaver AS ABAP, SAP Web Dispatcher, SAP Gateway, S4CRM, and SAP BusinessObjects. The current note set includes memory corruption, authentication bypass, code injection, cross-site request forgery, and XML external entity vulnerabilities. The total comprises 35 new SAP notes and three updates identified in the overview; this report also covers four High-priority GitHub advisories, which are counted separately from the SAP Security Notes.

Key Takeaways

• Prioritize the CVSS 10.0 issues in ICM, Web Dispatcher, Gateway, and SAML authentication: Notes 3778530, 3778556, 3798345, and 3849308. Reachability and authentication configuration determine which systems need the earliest maintenance windows.
• Treat Notes 3792735, 3809153, and 3834842 as paths from limited application access to code or command execution. Review technical users, remote authorizations, and access to XML transformation functionality alongside patching.
• Web Dispatcher and HANA deployments need deployment-specific handling. Notes 3778556, 3804858, and 3805681 include distinct XSA fixes, while Note 3803832 applies only to specified ABAP/Java routing configurations.
• Include application dependencies in the patch plan. The four GitHub advisories address Python identity verification and tenant isolation, JavaScript credential logging, and isolation of legacy Incus sandboxes in SAP/astonish.
• Keep the Medium and Low notes in the monthly cycle. Destination allowlists, password-file migration, browser content controls, and authorization checks require configuration or access reviews that a patch installation alone may not complete.

Critical-Priority Security Notes

The following nine notes require the closest attention this month. High-priority issues in reachable infrastructure and application dependencies also deserve immediate remediation planning.

3778530 / CVE-2026-76964: Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)

Priority: Critical

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 7).

• What Is Affected: SAP NetWeaver AS ABAP Internet Communication Manager, component BC-CST-IC, in kernel releases 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, and 9.20. AS Java is not affected.
• Scope of Use: Relevant to ABAP systems processing affected WebSocket traffic through ICM. Review both direct access and traffic arriving through a front-end dispatcher.
• Nature of the Vulnerability: Insufficient validation during WebSocket frame reassembly causes a heap-based out-of-bounds write. The network attack requires no privileges or user interaction; CVSS is 10.0.
• Attack Scenarios: An unauthenticated caller could send malformed traffic to reachable ICM functionality and trigger memory corruption, potentially executing code in the affected system.
• Business Impact: The note describes possible full system compromise, with high confidentiality, integrity, and availability impact. Business services hosted on the affected instance could lose both data protection and operational reliability.
• Mitigation and Recommendations: Apply the listed kernel correction and consult FAQ 3778788. A qualifying patched Web Dispatcher can provide a temporary workaround only when all affected ICM access passes through it. Disabling WebSocket is another documented option, with significant functional limitations.

3778556 / CVE-2026-89126: Memory Corruption vulnerability in SAP Web Dispatcher

Priority: Critical

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 13).

• What Is Affected: SAP Web Dispatcher, component BC-CST-WDP, including instances embedded in HANA XSC and XSA. Listed releases include Web Dispatcher 7.53, 7.54, 7.77, 7.93, and 9.16, HDB 2.00, and XSA runtime 1.00.
• Scope of Use: Applies wherever affected Web Dispatcher code handles WebSocket traffic, including standalone and embedded deployments. SAP Content Server is not affected.
• Nature of the Vulnerability: Improper validation of WebSocket frame lengths can cause a heap-based out-of-bounds write. Exploitation requires network access but no authentication or user interaction; CVSS is 10.0.
• Attack Scenarios: An attacker could target a reachable dispatcher with malformed network traffic and potentially execute arbitrary code in the affected environment.
• Business Impact: Full compromise could expose or alter information and interrupt services passing through the dispatcher. Its position in the request path can make disruption relevant to multiple business applications.
• Mitigation and Recommendations: Apply the listed Web Dispatcher/kernel patches and the applicable HANA revisions; update XSA to 1.5.4 or higher. FAQ 3778788 provides guidance. Disabling WebSocket is a temporary workaround with significant effects on interactive and integration scenarios.

3798345 / CVE-2026-89103: Broken Access Control in SAP Gateway

Priority: Critical

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 10).

• What Is Affected: SAP Gateway, component BC-CST-GW, across the listed kernel releases: 7.22, 7.22EXT, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, and 9.21.
• Scope of Use: Relevant where remote clients can reach the Gateway and its default access-control behavior. Review Gateway reachability and the trust assigned to connecting systems.
• Nature of the Vulnerability: The default access-control list can classify an external attacker as an internal application server with elevated trust. The attack is unauthenticated and network-based; CVSS is 10.0.
• Attack Scenarios: A caller reaching the Gateway could exploit the incorrect trust classification to perform unauthorized actions in the application environment.
• Business Impact: High confidentiality, integrity, and availability impacts mean unauthorized activity could affect sensitive information, business processing, and service continuity.
• Mitigation and Recommendations: Apply the kernel correction and complete the manual configuration steps, including setting gw/acl\_mode\_proxy = 1 as directed for the relevant releases. Consult FAQ 3810197 and Note 3224889. No workaround is available; restrict unnecessary Gateway access while scheduling the correction.

3849308 / CVE-2026-120017: Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)

Priority: Critical

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 3).

• What Is Affected: The ABAP SAML 2.0 service provider, component BC-SEC-LGN-SML. The PDF lists SAP_BASIS 702, 731, 740, a 750–816 From/To entry, and separate entries for 804, 918, and 920–922.
• Scope of Use: Relevant to SAML-based logon and federated identity in ABAP systems. The note limits exposure to certain configurations, including missing signature verification on incoming assertions.
• Nature of the Vulnerability: Insufficient verification of authentication assertions permits authentication bypass. The network attack requires no privileges or user interaction; CVSS is 10.0 with changed scope.
• Attack Scenarios: An unauthenticated attacker could submit a forged authentication response and impersonate arbitrary ABAP users, including privileged accounts.
• Business Impact: The note describes possible full system compromise, with high impact on confidentiality, integrity, and availability. Effects may extend to connected components and systems.
• Mitigation and Recommendations: Implement the correction instructions or support packages and consult FAQ 3849602. No workaround is available. Review SAML verification settings and reduce unnecessary access to authentication endpoints while arranging remediation.

3792735 / CVE-2026-76965: OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform

Priority: Critical

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 6).

• What Is Affected: SAPFTP functionality reached through RFC, component BC-SRV-COM-FTP, in the listed kernel releases 7.22, 7.22EXT, 7.53, 7.54, 7.77, 7.93, and 9.16.
• Scope of Use: Relevant to ABAP environments where users or technical accounts can invoke the affected FTP functionality. Authorization assignments determine which authenticated callers can reach it.
• Nature of the Vulnerability: Missing authorization checks allow a low-privilege attacker to execute operating-system commands. No user interaction is required; CVSS is 9.9 with changed scope.
• Attack Scenarios: A user with access to the affected remote functionality could move from permitted application access to unauthorized commands on the underlying host.
• Business Impact: Command execution can compromise sensitive data, alter processing, and interrupt services. The note states that resources beyond the vulnerable component can be affected.
• Mitigation and Recommendations: Apply the listed kernel/SAPFTP correction; the command and path restrictions are enabled by default. Consult FAQ 3807491. The documented workaround removes unnecessary S_RFC permissions for the SFTP function group and specified S_C_FUNCT permissions; assess business dependencies before changing roles.

3809153 / CVE-2026-109803: Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms)

Priority: Critical

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 5).

• What Is Affected: SAP NetWeaver Knowledge Management XML Forms, component EP-KM-CM, with software component KMC-CM 7.50.
• Scope of Use: Relevant where authenticated users can access XML Forms preview functionality and associated project resources. Review the permissions assigned to content contributors and technical users.
• Nature of the Vulnerability: Insufficient validation of selected XSL transformations can allow unauthorized transformations to execute. The CVSS 9.9 vector requires low privileges and no user interaction.
• Attack Scenarios: A user reaching the affected preview function could cause an unauthorized transformation to run, potentially executing code in the application context.
• Business Impact: Successful exploitation could compromise confidentiality, integrity, and availability. Unauthorized application execution can undermine the reliability of content processing and services that depend on it.
• Mitigation and Recommendations: Apply the listed support packages and patches. The correction accepts only transformations explicitly configured for the current project. As a temporary workaround, restrict XML Forms functionality and project resources to trusted users with necessary access; review existing project configurations before rollout.

3834842 / CVE-2026-109795: Missing authorization check in S4CRM

Priority: Critical

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 6).

• What Is Affected: CRM Survey Suite functionality, component CRM-BF-SVY, in S4CRM 204–206, S4CEXT 107–109, and BBPCRM 713–714.
• Scope of Use: Applies where the affected remote-enabled functionality is available to authenticated users. Review the technical accounts and integrations permitted to invoke XML/XSLT processing.
• Nature of the Vulnerability: Missing authorization checks and insufficient input validation allow code injection through a remote interface. The CVSS 9.9 vector requires low privileges and no user interaction.
• Attack Scenarios: A low-privilege caller could submit malicious input to affected transformation functionality and execute arbitrary code within the system.
• Business Impact: High confidentiality, integrity, and availability impacts create a risk to CRM information and dependent processing. The note states that exploitation can extend beyond the vulnerable component.
• Mitigation and Recommendations: Apply the attached correction instructions or relevant support package and complete applicable manual activities. The fix adds authorization checks and XSLT-injection defenses. No workaround is available; review unnecessary remote access while preparing the correction.

3804858 / CVE-2026-89119, CVE-2026-120014: Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager

Priority: Critical

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 5).

• What Is Affected: Web Dispatcher/ICM Administration UI, component BC-CST-WDP, in the listed 7.93, 9.16, 9.20, and 9.21 kernel/Web Dispatcher entries, plus XSA runtime 1.00. AS Java and HANA XSC Web Dispatcher are not affected.
• Scope of Use: The Administration UI must be used and an admin-role user configured. Installations without such users are not affected under the prerequisites described in the note.
• Nature of the Vulnerability: Missing request validation permits CSRF against an administrator’s session. CVE-2026-89119 scores 9.6; the separate XSA issue, CVE-2026-120014, scores 7.6. Both require user interaction.
• Attack Scenarios: An unauthenticated attacker could induce a logged-on administrator to visit a malicious link, causing unintended administrative actions through that session.
• Business Impact: The ABAP/Web Dispatcher issue can lead to operating-system compromise. The XSA issue can temporarily compromise its dispatcher, with high confidentiality and lower integrity and availability impacts.
• Mitigation and Recommendations: Apply listed patches and update XSA to 1.5.5 or higher. Consult FAQ 3810549. Workarounds disable Administration UI access with the required restart, or replace the admin role with monitor; assess operational effects before implementation.

3799117 / CVE-2026-109798: XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

Priority: Critical

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 8).

• What Is Affected: BusinessObjects Web Intelligence OLAP connection processing, component BI-BIP-SL, in ENTERPRISE releases 430, 2025, and 2027.
• Scope of Use: Relevant to environments providing affected Web Intelligence connection functionality. Assess which authenticated users can submit the OLAP connection requests processed by this component.
• Nature of the Vulnerability: External entity resolution is insufficiently restricted. An authenticated attacker with low privileges can access restricted resources without user interaction; CVSS is 9.1 with changed scope.
• Attack Scenarios: A caller could abuse XML processing to read sensitive server files or reach internal systems that are otherwise inaccessible through the exposed application interface.
• Business Impact: High confidentiality impact can expose information beyond a single report or connection. The note also identifies low integrity and availability impacts and effects beyond the vulnerable component.
• Mitigation and Recommendations: Implement the listed support packages and patches, which strengthen XML processing and OLAP parameter validation. Consult FAQ KBA 3839332. No workaround is available; review access to affected connection functionality and unnecessary internal connectivity during remediation planning.

High-Priority Security Notes

This section covers 13 SAP Security Notes and four separately counted GitHub advisories, ordered by CVSS score.

3769130 / CVE-2026-76966, CVE-2026-109796: Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 6).

• What Is Affected: AS ABAP RFC/kernel processing, component BC-MID-RFC, in listed releases 7.22, 7.22EXT, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, and 9.20.
• Scope of Use: Relevant where RFC services are reachable and affected kernel components process remote requests. The two CVEs have different privilege and complexity requirements.
• Nature of the Vulnerability: CVE-2026-76966 is unauthenticated RFC memory corruption with high attack complexity and CVSS 8.9. CVE-2026-109796 exposes uninitialized memory to low-privilege attackers and scores 4.3.
• Attack Scenarios: An unauthenticated caller could target RFC validation errors; a separate authenticated path could disclose residual memory under the conditions described in the note.
• Business Impact: The higher-scoring issue has high confidentiality and integrity impacts and low availability impact. The second issue has low confidentiality impact without integrity or availability effects.
• Mitigation and Recommendations: Apply the listed kernel patches and consult FAQ 3774165. No workaround is available. Review unnecessary RFC reachability and technical-user permissions while scheduling the correction.

3809953 / CVE-2026-120008: Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service)

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 5).

• What Is Affected: Internet Graphics Service, component BC-FES-IGS, releases 7.20EXT, 7.20_EX2, 7.53, 7.54, 7.81, and 9.16.
• Scope of Use: Relevant to systems using the affected IGS worker functionality. Review which applications and network paths can submit requests to the service.
• Nature of the Vulnerability: Insufficient input validation permits an out-of-bounds memory write. The CVSS 8.2 attack requires neither authentication nor user interaction.
• Attack Scenarios: A remote caller could send a malformed request that corrupts worker memory or repeatedly terminates the affected process.
• Business Impact: High availability impact can interrupt graphics-dependent processing. The source identifies low integrity impact and no confidentiality impact; broader data disclosure is not established.
• Mitigation and Recommendations: Implement the listed support packages and patches. Note 3843543 supplies download and installation guidance. There is no workaround, so reduce unnecessary IGS reachability and verify the corrected service version after maintenance.

3803832 / CVE-2026-109800: Memory Corruption vulnerability in SAP Web Dispatcher

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 4).

• What Is Affected: Web Dispatcher, component BC-CST-WDP, in listed releases 7.53, 7.54, 7.77, 7.93, and 9.16, with additional kernel entries for 9.20 and 9.21.
• Scope of Use: Applies only to Web Dispatcher in front of AS ABAP or AS Java with MSHOST or MSSHOST in its profile. HANA-only, third-party-only, and HANA Extended Application Services deployments are excluded as described in the note.
• Nature of the Vulnerability: Insufficient validation causes memory corruption and process termination. A non-administrative authenticated user can trigger it without user interaction; CVSS is 7.7.
• Attack Scenarios: A user reaching the affected routing configuration could submit input that terminates the dispatcher process.
• Business Impact: The dispatcher and backend systems accessed through it become unavailable. The note identifies high availability impact without confidentiality or integrity impact.
• Mitigation and Recommendations: Apply the listed Web Dispatcher/kernel patches. No workaround is available. Check profile conditions before assigning remediation scope and validate routing and backend availability after patching.

3789273 / CVE-2026-76973: Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server)

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 7).

• What Is Affected: SAP Message Server, component BC-CST-MS, across listed kernel releases 7.22, 7.22EXT, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20, and 9.21.
• Scope of Use: Relevant where remote clients can reach the affected Message Server endpoints. Include internal network access in the exposure assessment.
• Nature of the Vulnerability: Integer and buffer overflow conditions can corrupt memory. The network attack requires no privileges or user interaction; CVSS is 7.5.
• Attack Scenarios: An unauthenticated caller could send malformed requests that crash the service and disrupt active connections.
• Business Impact: The source identifies high availability impact and no confidentiality or integrity impact. Connection disruption can interrupt business applications relying on the service.
• Mitigation and Recommendations: Apply the listed kernel correction and consult FAQ 3793651. No workaround is available. Restrict unnecessary Message Server access and test connection behavior after updating the running kernel.

3792915 / CVE-2026-76970: Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 2).

• What Is Affected: ABAP Dynpro/CUA processing, component BC-ABA-SC, across the listed kernel releases, including 7.22 variants, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20, and 9.21.
• Scope of Use: Relevant to affected application-server request parsing. Assess exposure through the application paths that reach the vulnerable processing routine.
• Nature of the Vulnerability: Improper boundary validation can cause memory corruption. The CVSS 7.5 network attack requires no authentication or user interaction.
• Attack Scenarios: A remote attacker could submit malformed requests that crash and restart affected processes; repeated triggering could sustain an outage.
• Business Impact: High availability impact can disrupt application sessions and processing. Confidentiality and integrity remain unaffected according to the note.
• Mitigation and Recommendations: Apply the listed kernel patches and consult FAQ 3746868. No workaround is available. Confirm patch availability for each kernel release and verify process stability after maintenance.

3805570 / CVE-2026-120010: Memory Corruption vulnerability in SAP NetWeaver Application Server (SAP Message Server)

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 4).

• What Is Affected: SAP Message Server, component BC-CST-MS, in listed kernel releases 7.22, 7.22EXT, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20, and 9.21.
• Scope of Use: Relevant to Message Server functionality handling affected HTTP requests. Review access to these service interfaces alongside other Message Server corrections.
• Nature of the Vulnerability: Incorrectly sized memory allocations can cause a heap buffer overflow. CVSS is 7.5; authentication and user interaction are not required.
• Attack Scenarios: An unauthenticated caller could cause the component to abort through malformed input, leaving it unavailable until the framework restarts it.
• Business Impact: The source identifies high availability impact without confidentiality or integrity effects. Repeated interruptions could affect applications depending on the service.
• Mitigation and Recommendations: Apply the listed kernel patch levels or subsequent levels containing the correction. There is no workaround. Validate that the running Message Server binary has been updated and check service recovery and application connectivity.

3805681 / CVE-2026-109794: Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 3).

• What Is Affected: ICM/Web Dispatcher processing, component BC-CST-IC, in listed kernel/Web Dispatcher releases 7.77, 7.93, and 9.16, plus XSA runtime 1.00.
• Scope of Use: Relevant to affected request processing in ABAP, Web Dispatcher, and XSA deployments. AS Java and HANA XSC Web Dispatcher are not affected.
• Nature of the Vulnerability: Inadequate resource-consumption handling allows unauthenticated network requests to exhaust resources. No user interaction is required; CVSS is 7.5.
• Attack Scenarios: A remote caller could send requests that consume excessive resources and degrade or interrupt service availability.
• Business Impact: Availability is affected at a high level, while confidentiality and integrity are unaffected. Business applications may slow or become inaccessible through the affected component.
• Mitigation and Recommendations: Apply the listed kernel/Web Dispatcher patches; update XSA to 1.5.5 or higher. A documented workaround sets ict/disable\_brotli = TRUE and restarts Web Dispatcher and application servers. It disables Brotli compression while retaining GZIP support.

3808552 / CVE-2026-109804: Information Disclosure in SAP NetWeaver (SAP Message Server)

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 8).

• What Is Affected: SAP Message Server, component BC-CST-MS, in listed kernel releases 7.53, 7.54, 7.77, 7.93, 9.16, 9.20, and 9.21.
• Scope of Use: Relevant where the affected external Message Server port is reachable. Review which clients and network segments have access to that interface.
• Nature of the Vulnerability: An error path can return uninitialized memory. The network attack requires no privileges or user interaction; CVSS is 7.5.
• Attack Scenarios: An unauthenticated caller could submit malformed input and retrieve sensitive information from memory returned when processing fails.
• Business Impact: The note identifies high confidentiality impact without integrity or availability effects. Disclosure can undermine protection of information handled by shared infrastructure.
• Mitigation and Recommendations: Apply listed kernel patches, which initialize memory and improve error handling. No workaround is available. Review unnecessary external-port access and confirm that the corrected Message Server is running after the update.

3808627 / CVE-2026-109793: Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 7).

• What Is Affected: ICM and SAP Web Dispatcher request processing, component BC-CST-DP. Listed software components are WEBDISP 9.16 and KERNEL 9.16, 9.20, and 9.21.
• Scope of Use: Relevant to systems accepting inbound requests through affected ICM or dispatcher instances. Include trusted-network entry points in the review.
• Nature of the Vulnerability: Insufficient validation of request-header values can make the affected process unavailable. The CVSS 7.5 network attack is unauthenticated and requires no user interaction.
• Attack Scenarios: A caller could submit malformed request headers that interrupt the service, potentially affecting users whose traffic shares the same process.
• Business Impact: Availability is affected at a high level. The note identifies no confidentiality or integrity impact, so the immediate concern is service continuity.
• Mitigation and Recommendations: Apply the listed Web Dispatcher/kernel patches, which improve parsing validation and error handling. No workaround is available. Verify the corrected runtime and test application access through the affected entry points.

3809934 / CVE-2026-109806, CVE-2026-109807: Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 6).

• What Is Affected: Internet Graphics Service, component BC-FES-IGS, releases 7.20EXT, 7.20_EX2, 7.53, 7.54, 7.81, and 9.16, using the PDF’s release identifiers.
• Scope of Use: Relevant to applications submitting requests or image data to affected IGS workers. Review service access and dependencies alongside the separate IGS memory-write correction.
• Nature of the Vulnerability: The note covers an integer overflow and an out-of-bounds read. Both score 7.5 and require neither authentication nor user interaction.
• Attack Scenarios: A remote caller could submit malformed input that repeatedly terminates an IGS worker process through either vulnerability.
• Business Impact: Both issues have high availability impact without confidentiality or integrity impact. Repeated worker failures could interrupt dependent graphics processing.
• Mitigation and Recommendations: Apply listed support packages and patches, which add input validation. Note 3843543 supplies installation guidance. No workaround is available; validate the corrected IGS release and dependent application functions after maintenance.

3810485 / CVE-2026-89114: Missing Authentication check in SAP NetWeaver AS Java EDM Application

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 10).

• What Is Affected: The AS Java EDM application, component BC-DWB-JAV-J2E, with software component CE-RA-EDM 7.50.
• Scope of Use: Relevant where the application and its affected web services remain deployed and reachable. Confirm deployment status before assuming exposure from the wider Java platform alone.
• Nature of the Vulnerability: Certain web service requests lack authentication checks. The CVSS 7.5 attack requires network access but no privileges or user interaction.
• Attack Scenarios: An unauthenticated caller could request protected resources and obtain sensitive business information through the affected services.
• Business Impact: Confidentiality is affected at a high level. The note identifies no integrity or availability impact, making unauthorized information access the direct business concern.
• Mitigation and Recommendations: Apply listed support packages and patches; the fix removes the EDM application through SUM updates. Consult dependency guidance in Note 1974464. The temporary workaround disables the application using the documented filter and requires a restart.

3842766 / CVE-2026-120015: Insufficient Input Validation in SAP Host Agent

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 5).

• What Is Affected: SAP Host Agent 7.22, component BC-CCM-HAG, when a specialized SAP internal monitoring configuration is active.
• Scope of Use: The stated configuration is a prerequisite. Inventory Host Agent versions and determine whether that monitoring functionality is enabled before assigning exposure.
• Nature of the Vulnerability: Insufficient input validation can cause an internal component to load a malicious file under a privileged account. The CVSS 7.5 attack requires low privileges and high complexity.
• Attack Scenarios: Under the required configuration, a low-privilege attacker could influence the affected loading behavior and obtain persistent code execution.
• Business Impact: The note identifies high confidentiality, integrity, and availability impacts. Persistent execution under a privileged account could compromise the host’s information and operational reliability.
• Mitigation and Recommendations: Upgrade to SAP Host Agent 7.22 PL72 or a subsequent applicable patch. Notes 2219592 and 1031096 provide upgrade and installation guidance. No workaround is available; validate both the installed and running agent version.

GHSA-28c8-457r-4cf6 / CVE-2026-120013: Path Traversal in Agent Memory Module of SAP Cloud SDK for Python

Priority: High

Source: GitHub Security Advisory, SAP/cloud-sdk-python

• What Is Affected: The agent\_memory module in the pip package sap-cloud-sdk, versions earlier than 0.50.0.
• Scope of Use: Relevant to applications using tenant-specific secret resolution through this module, particularly where credentials for multiple tenants are mounted in the environment.
• Nature of the Vulnerability: Caller-supplied tenant values are insufficiently validated before filesystem paths are resolved. The CVSS 7.5 network attack requires no privileges or user interaction.
• Attack Scenarios: An attacker influencing the tenant value could cause secret resolution to cross the intended tenant boundary and access another tenant’s mounted credentials.
• Business Impact: Exposure of OAuth client IDs and client secrets can undermine tenant isolation and enable unauthorized use of associated credentials. The source vector identifies high confidentiality impact.
• Mitigation and Recommendations: Upgrade to 0.50.0 or later. As a temporary workaround, validate tenant values against an allowlist of registered tenant subdomains before calling the SDK. Review access to mounted credentials and consider rotation if exposure is suspected.

GHSA-8g7j-49xg-8wf3 / CVE-2026-120012: Information Disclosure vulnerability in SAP Cloud SDK for AI (JavaScript)

Priority: High

Source: GitHub Security Advisory, SAP/ai-sdk-js

• What Is Affected: The npm package @sap-ai-sdk/ai-api, versions 2.17.0 and earlier, in SAP Cloud SDK for AI applications using Node.js.
• Scope of Use: Relevant where affected internal operations produce error messages that are retained in application logs or forwarded error output.
• Nature of the Vulnerability: Error messages can contain sensitive authentication credentials. The CVSS 7.5 vector requires low privileges and high complexity; exploitation depends on a suitable failure event and token lifetime.
• Attack Scenarios: A user able to read affected logs could obtain credentials exposed during a higher-privilege user’s failure event and reuse them before they expire.
• Business Impact: Reused credentials could affect the associated SAP service, with high confidentiality, integrity, and availability impacts identified by the advisory.
• Mitigation and Recommendations: Upgrade to 2.18.0, which removes destination information from logged values. No workaround is available. Review log access and retention, and investigate whether affected error output contains credentials requiring revocation or rotation.

GHSA-93m8-crj2-v997 / CVE-2026-109799: Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing

Priority: High

Source: GitHub Security Advisory, SAP/cloud-sdk-python

• What Is Affected: IASContextProvider in the pip package sap-cloud-sdk, versions earlier than 0.63.1. The provider is registered by default through application bootstrapping.
• Scope of Use: Relevant where applications trust runtime-context identities for telemetry, logs, audit events, or tenant routing. Review how downstream consumers use those identities.
• Nature of the Vulnerability: The provider reads identity claims without validating the JWT signature. CVSS is 7.5, with no privileges or user interaction required and high integrity impact.
• Attack Scenarios: A remote caller could supply an untrusted token naming another tenant or user, causing the forged identity to propagate into runtime-context consumers.
• Business Impact: Misattributed audit events, logs, and telemetry can weaken accountability; tenant routing based on the forged context can also become untrustworthy. The source vector does not establish confidentiality or availability impact.
• Mitigation and Recommendations: Upgrade to 0.63.1, which verifies signatures and returns an empty context when verification cannot succeed. Workarounds enforce signature verification at ingress or supply an explicitly verified TokenVerifier. Validate the application’s IAS verification configuration.

3833364 / CVE-2026-120009: Code Injection vulnerability in SAP ABAP Developer Tools (AMDP Data Preview)

Priority: High

Update to Security Note; original Patch Day not specified in the SAP source (PDF version 6).

• What Is Affected: AMDP Data Preview in ABAP Developer Tools, component BC-DWB-AIE-DP. The PDF lists SAP_BASIS 740, a 750–816 From/To entry, and 920.
• Scope of Use: Relevant to development-tool access and the affected data-preview functionality. Review developer and administrative permissions in systems where the feature is available.
• Nature of the Vulnerability: Insufficient validation and authorization allow code injection. The CVSS 7.2 network attack requires high privileges but no user interaction.
• Attack Scenarios: A privileged user could abuse the affected handling of expressions to execute unauthorized code or modify data beyond the intended preview function.
• Business Impact: The note describes possible full compromise with high confidentiality, integrity, and availability impacts. Preview access can therefore carry consequences beyond viewing data.
• Mitigation and Recommendations: Implement the correction instructions or support packages, which deprecate the affected functionality. Consult FAQ 3840292. The documented workaround revokes access to ABAP Development Tools completely and should be assessed for its effect on development and support activities.

GHSA-93c9-96j8-4vg9 / CVE-2026-109797: Cross-tenant sandbox takeover in SAP/astonish

Priority: High

Source: GitHub Security Advisory, SAP/astonish

• What Is Affected: SAP/astonish versions earlier than v3.6.0 using the legacy Incus sandbox backend. Kubernetes and OpenShell deployments are not affected.
• Scope of Use: Relevant where multiple teams use affected Incus sandbox-management handlers. Confirm the active backend rather than relying solely on the application’s package version.
• Nature of the Vulnerability: Improper tenant isolation allows authenticated users to operate on another team’s containers. The CVSS 7.1 vector requires low privileges and no user interaction.
• Attack Scenarios: A user could identify another team’s sandbox and perform unauthorized container operations, including exposure, proxying, or deletion.
• Business Impact: The advisory identifies low confidentiality impact and high availability impact. Cross-team access or deletion can expose limited information and disrupt another team’s sandbox work.
• Mitigation and Recommendations: Upgrade to v3.6.0, which adds tenant-aware session lookup or equivalent checks. No workaround is available. Verify the backend in use and review sandbox access boundaries after applying the fix.

Medium and Lower Priority Notes

The remaining 16 SAP notes address authorization, request handling, browser trust, and credential protection. Their lower scores often reflect required privileges, user interaction, or specific deployment conditions; several still require configuration changes or manual follow-up.

ABAP and Java service boundaries

Note 3793716 (RFC input-validation denial of service in AS ABAP, CVSS 6.5) allows authenticated requests to crash affected work processes; apply the kernel correction and consult FAQ 3794042. Note 3805959 (SSRF in the ABAP HTTP component, CVSS 6.5) can expose a victim’s information and allow limited changes after user interaction; implement the correction and the manual allowlist activities referenced in FAQ 3834382. Note 3839977 (authorization vulnerabilities in AS Java NWDI Cockpit, CVSS 6.5) covers separate information-disclosure and unauthorized-modification issues; apply the corrected server-side authorization checks. Note 3786876 (weak RFC callback cryptography in AS ABAP, CVSS 6.4) requires high privileges and access to communication between application servers, but can enable caller impersonation and unauthorized function execution; apply the kernel’s hardened HMAC calculation.

Web content, callbacks, and credential storage

Note 3797108 (CSS injection in Web Dynpro Java, CVSS 6.1) can load attacker-controlled styling after a user follows a malicious link, supporting interface deception and limited content disclosure; patch and explicitly allow required external theme hosts. Note 3806484 (reflected XSS in Visual Composer, CVSS 6.1) can execute script in a victim’s browser after interaction; the correction encodes reflected request parameters. Note 3782056 (outdated password hashing in Web Dispatcher and ICM, CVSS 6.0) can expose credentials to an administrator with access to stored data; patching must be followed by manual migration of existing password files/users, as described in FAQ 3842490. Note 3835738 (SSRF in AS Java WS-Addressing callbacks, CVSS 5.8) can expose information about connected systems without authentication; apply the patch, configure wsa.callback.whitelist, and review legitimate private-network callbacks before rollout.

User content and supporting service protection

Note 3671819 (XSS in applications based on SAP GUI for HTML, CVSS 5.4) is an update to the October 2026 Patch Day note, with revised correction-instruction information; apply the current correction and review documented changes to permitted HTML resources. Note 3792447 (broken access control in the Process Integration Test Tool, CVSS 5.3) exposes information through unauthenticated SOAP operations; the patch removes the affected functions, with implementation guidance in Note 952402. Note 3803144 (Apache Struts denial of service in BusinessObjects, CVSS 5.3 in the PDF) requires limited access and knowledge of internal identifiers but can cause excessive memory consumption; apply the packages that redirect the affected endpoint and update Struts to 6.11. Note 3740168 (credential disclosure in SAP Start Service and SAP Microsoft Management Console, CVSS 4.4) requires privileged local access to process memory; apply the applicable kernel, MMC, and HANA corrections that clear passwords after processing.

Portal, WebClient, and support-tool controls

Note 3801587 (CSRF in Enterprise Portal, CVSS 4.3) can cause a logged-on user to perform unintended changes to non-sensitive information; apply the endpoint protection supplied in the listed patches. Note 3101986 (WebClient UI CSP dependency support, CVSS 4.1) updates the April 2022 Patch Day note with textual changes to its title and symptom; apply the support package and applicable manual activity for S4FND 104, while reviewing the referenced CSP dependencies. Note 3155685 (WebClient UI CSP security misconfiguration, CVSS 4.1) updates the July 2026 Patch Day note with title and symptom changes; implement the correction instructions or support packages enabling CSP support for S4FND 104–106. Note 3802244 (missing authorization in SAP Solution Tools Plug-In, CVSS 3.1) permits restricted information access by an authenticated caller under specific conditions; apply the correction instructions or support package and review access to the affected remote functionality.

What Does This Patch Day Tell Us?

Three patterns stand out this month. First, identity and trust decisions remain central: the SAML authentication issue, Gateway access-control failure, and Python JWT advisory each allow an untrusted caller to influence an identity or trust boundary. Second, shared infrastructure is an availability concern: multiple Message Server, ICM, Web Dispatcher, and IGS issues can interrupt processing without authentication. Third, remediation often extends beyond installing a patch: Gateway parameters, password-file migration, callback allowlists, application removal, and dependency upgrades each require an operational follow-up.

Patching should be prioritized by exposure as much as by CVSS. Reachable ABAP authentication and Gateway services, Web Dispatcher instances, and affected remote execution paths need rapid handling, while configuration prerequisites should guide the scope of each change. The included SDK and sandbox advisories also require application-owner involvement, because package and backend choices determine exposure. Medium and Low notes belong in the same monthly cycle so that corrected code, permissions, and configuration reach production together.

Final Recommendations by Pathlock

• Patch the nine Critical notes in score order: 3778530, 3778556, 3798345, 3849308, 3792735, 3809153, 3834842, 3804858, and 3799117. Follow with the 13 High-priority SAP notes and four included GitHub advisories, adjusting maintenance order for actual reachability and prerequisites.
• Complete deployment-specific follow-up. Verify the applicable XSA versions, update and validate running kernel/IGS/Host Agent binaries, remove or disable the affected EDM application as directed, and confirm that corrected SDK packages are deployed in the running applications.
• Review SAML verification, Gateway trust settings, RFC permissions, Message Server ports, and Web Dispatcher administration access before and after remediation. Use documented workarounds only where their prerequisites and functional effects are understood.
• Close the Medium and Low backlog with explicit owners for destination and callback allowlists, existing password-file migration, external theme-host configuration, and remote-function authorization checks. Confirm functional behavior after these changes.
• Validate isolation and accountability across ABAP, Java, and cloud applications. Review tenant-context consumers, sandbox permissions, credential-bearing logs, and privileged technical users; rotate or revoke credentials where evidence or investigation indicates exposure.

Sources reviewed

SAP Security Notes: 3849308, 3842766, 3839977, 3835738, 3834842, 3833364, 3810485, 3809953, 3809934, 3809153, 3808627, 3808552, 3806484, 3805959, 3805681, 3805570, 3804858, 3803832, 3803144, 3802244, 3801587, 3799117, 3798345, 3797108, 3793716, 3792915, 3792735, 3792447, 3789273, 3786876, 3782056, 3778556, 3778530, 3769130, 3740168, 3671819, 3155685, 3101986.