SAP NetWeaver / Web Dispatcher: four CVSS 10.0 pre-auth flaws patched, incl. SAML bypass (CVE-2026-120017)
Severity: critical · Patch status: patched · Since 2026-11-10 · CVE-2026-120017, CVE-2026-76964, CVE-2026-89103, CVE-2026-89126
On SAP's November 2026 Security Patch Day (10 Nov), SAP published four security notes, each rated CVSS 10.0 by SAP as CNA, and each flaw is reachable without authentication or user interaction. CVE-2026-76964 (ICM, Note 3778530) and CVE-2026-89126 (Web Dispatcher, Note 3778556) are memory-corruption bugs triggered by insufficiently validated network input, which SAP says can allow arbitrary code execution. CVE-2026-89103 (SAP Gateway, Note 3798345) is a default access control list that classifies an external attacker as an internal application server. CVE-2026-120017 (SAML2 service provider in AS ABAP, Note 3849308) does not sufficiently verify incoming authentication assertions under certain configurations, which lets an attacker impersonate arbitrary users, including privileged accounts. SAP's page lists the affected releases per note, including the HANA-related Web Dispatcher components HDB 2.00, XSADVANCEDRUNTIME 1.00 and SAPEXTENDEDAPPSERVICES 1. Neither SAP's page nor NVD reports exploitation or a public proof of concept, and none of the four CVEs is in the CISA KEV feed checked on 2026-11-09. Patch each note for the components you run, and review SAML2 logons and Gateway access control, which are the paths these flaws describe.
What to do
- Patch SAP Note 3849308 (CVE-2026-120017) on AS ABAP systems that use SAML2 browser logon, and review trusted identity providers and SAML2 logon audit logs for privileged users logging on from unexpected sources
- Patch SAP Note 3778530 (ICM, CVE-2026-76964) and SAP Note 3778556 (Web Dispatcher, CVE-2026-89126) together, and find every Web Dispatcher instance, including the HANA-related components listed on SAP's page
- Patch SAP Note 3798345 (Gateway, CVE-2026-89103) and review Gateway access control lists, since the flaw is in default ACL handling
- Check each system's release level against the affected lists on SAP's page, and confirm the fixed release level in each note, which this record did not verify
Fixed versions
- SAP Notes 3778530 (ICM), 3778556 (Web Dispatcher), 3798345 (Gateway), 3849308 (SAML2 service provider); fixed release levels per note not verified
Sources
All live incidents on Threat Watch
