SAP Patches Four Flaws in NetWeaver and Web Dispatcher

SAP has released security updates to fix four critical vulnerabilities rated 10.0 on the CVSS scale across SAP NetWeaver Application Server and SAP Web Dispatcher as part of its November 2026 Security Patch Day. All four security flaws can be exploited over a network without authentication and require no user interaction to execute. Two of the vulnerabilities enable remote code execution, while others permit complete user impersonation or unauthorised server actions. Organisations in Malaysia running affected SAP environments can report any suspected compromise to Cyber999 (MyCERT).

Key Facts

How Do the Memory Corruption Flaws Allow Code Execution?

The Internet Communication Manager and Web Dispatcher vulnerabilities allow network attackers to trigger heap memory corruption by sending crafted WebSocket control frames with invalid length fields. Because these components parse web traffic before authentication takes place, a remote attacker can execute arbitrary code and fully compromise the server without needing valid user credentials.

Both CVE-2026-76964, affecting the Internet Communication Manager (ICM) in SAP NetWeaver AS ABAP, and CVE-2026-89126, affecting standalone and embedded SAP Web Dispatchers, share this heap out-of-bounds write mechanism. According to third-party analysis by security firm RedRays, SAP NetWeaver AS Java is unaffected by the ICM bug, and SAP Content Server is not susceptible to the Web Dispatcher flaw. The Web Dispatcher defect impacts standalone instances as well as deployments in SAP HANA XS Classic and XS Advanced. If users access ICM exclusively through a Web Dispatcher, patching the Web Dispatcher to levels documented in FAQ note 3778788 shields the ICM component, provided ICM network ports cannot be accessed directly.

Crafted WebSocket control frames with invalid lengths allow unauthenticated attackers to corrupt heap memory and achieve remote code execution on vulnerable ICM and Web Dispatcher components.

How Can Attackers Bypass Authentication and Impersonate Servers?

Attackers can bypass identity checks through flaws in SAML2 service provider and SAP Gateway components. Under specific configurations, SAML2 fails to verify cryptographic signatures on incoming assertions, granting administrative access without valid credentials. Concurrently, insecure default access control lists in SAP Gateway allow external attackers to impersonate internal application servers and execute unauthorised commands.

In CVE-2026-120017, the SAML2 service provider for SAP NetWeaver AS ABAP and ABAP Platform fails to check signatures on incoming assertions under certain configurations. This allows unauthenticated external threat actors to log in as any user—including administrative and privileged accounts—on systems using SAML2 for browser logon, such as Fiori Launchpad or Web GUI. This contrasts with CVE-2026-44748, a separate SAML flaw patched on 9 June, which required valid standard user credentials. In CVE-2026-89103, SAP Gateway access control lists fall back to permissive default rules when secinfo and reginfo lack explicit entries or rely on the internal host keyword. This enables external callers to masquerade as the system's own internal application servers and access standard gateway execution paths.

The SAML2 vulnerability permits unauthenticated logins as privileged users, whilst the SAP Gateway flaw enables external attackers to masquerade as trusted internal servers.

What Should You Do?

• Apply the official updates for SAP Note 3778530, Note 3778556, Note 3798345, and Note 3849308 directly from SAP for Me.
• Execute a single rollout to update the kernel and all Web Dispatchers, deploying SAPWEBDISP.SAR for standalone instances, dw.sar or the SP Stack Kernel for embedded setups, SPS08 revision 089.05 or SPS07 revision 079.11 for HANA XS Classic, and version 1.5.4 or later for XS Advanced.
• Harden SAP Gateway by configuring profile parameter gw/acl_mode_proxy (introduced in kernels up to 7.77 and pre-existing from 7.93 onwards), ensuring gw/acl_mode is set to 1, maintaining explicit rules in secinfo and reginfo, and blocking access to gateway port 33xx from user networks and the internet.
• Review all trusted identity providers in transaction SAML2 and inspect system audit logs for anomalous privileged SAML logons originating from unrecognised sources.
• Where patching must be delayed, disable WebSocket support as a temporary mitigation for ICM and Web Dispatcher bugs, noting that this disables ABAP Push Channels and dependent Fiori features.

Common Questions

Are workarounds available for all four vulnerabilities?

No. The SAP Gateway (CVE-2026-89103) and SAML2 (CVE-2026-120017) security notes state that no workarounds exist, making official patches mandatory. For the ICM and Web Dispatcher flaws, disabling WebSocket support serves as a temporary workaround, though it breaks features relying on ABAP Push Channels.

Which SAP environments are exempt from the memory corruption flaws?

SAP NetWeaver AS Java is unaffected by the ICM flaw (CVE-2026-76964), and SAP Content Server is not impacted by the Web Dispatcher flaw (CVE-2026-89126). However, both standalone and embedded Web Dispatchers across SAP HANA XS Classic and XS Advanced remain vulnerable.

Does the SAML2 vulnerability require existing user credentials?

No. Unlike CVE-2026-44748 resolved on 9 June, which required a valid standard user account, CVE-2026-120017 allows an unauthenticated external attacker to log in as any user, including privileged accounts, because the service provider fails to validate digital signatures on incoming assertions.

Sources and Methodology

This dispatch is based solely on reporting published by The Hacker News on 10 November 2026. ROCKSTARmedia Infosec has not independently reviewed, verified, or inspected vendor-restricted advisories in SAP for Me, kernel source packages, or underlying third-party technical analyses.