SAP has released patches for multiple critical vulnerabilities across its enterprise software portfolio, including flaws in SAP NetWeaver, SAP Web Dispatcher and SAP Gateway that could enable arbitrary code execution or full system compromise. The company’s November 2026 Security Patch Day includes 35 new security notes and four GitHub security advisories.
The most serious issue is CVE-2026-76964, a memory-corruption vulnerability in the Internet Communication Manager component of SAP NetWeaver AS ABAP. SAP rates it critical with a CVSS score of 10.0. According to the NVD description, an unauthenticated attacker can send specially crafted network traffic to trigger the flaw; successful exploitation could permit arbitrary code execution and compromise confidentiality, integrity and availability. The issue affects multiple kernel releases, including SAP NetWeaver and ABAP Platform versions 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20, with remediation provided under SAP Security Note 3778530.
A related memory-corruption bug, CVE-2026-89126, affects SAP Web Dispatcher and also carries a CVSS 10.0 rating. Web Dispatcher commonly sits at the edge of an SAP deployment as a reverse proxy and load balancer, which makes internet-facing instances particularly important to inventory and patch. SAP also disclosed CVE-2026-89103, a critical broken-access-control vulnerability in SAP Gateway rated CVSS 10.0, alongside a critical S4CRM authorization flaw, CVE-2026-109795, rated 9.9.
The release extends beyond the core application stack. SAP’s advisory lists a high-severity code-injection vulnerability in ABAP Developer Tools, CVE-2026-120009, with a CVSS score of 7.2. It also covers three high-severity SAP Cloud SDK issues: JWT-signature verification allowing tenant or user identity spoofing in the Python package, path traversal in its Agent Memory Module, and information disclosure in SAP Cloud SDK for AI for JavaScript. The affected package ranges include Python releases earlier than 0.63.1 and 0.50.0, and JavaScript releases up to 2.17.0, respectively.
SAP has not reported exploitation in the wild, public proof-of-concept code or threat-actor attribution in its patch-day summary. Administrators should nevertheless prioritize the vendor’s fixes, beginning with internet-exposed NetWeaver AS ABAP and Web Dispatcher systems, then review Gateway, S4CRM, ABAP Developer Tools and Cloud SDK deployments. SAP recommends that customers consult the individual security notes in the support portal and apply the relevant kernel, application or library updates as soon as operationally possible.
