SAP Security Patch Day, November 2026: the CVEs
Filter
SAP Security Patch Day November 2026: the CVEs SAP published on 10 November 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Oct 2026, Sep 2026, Aug 2026, Jul 2026, Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday
- 10.0CVE-2026-89126EPSS 0.4%
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected f…
- 9.6CVE-2026-89119EPSS 0.1%
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispa…
- 10.0CVE-2026-89103EPSS 0.3%
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could ex…
- 9.9CVE-2026-76965EPSS 0.3%
SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating …
- 10.0CVE-2026-76964EPSS 0.4%
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption conditio…
- 10.0CVE-2026-120017EPSS 0.3%
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication a…
- 9.9CVE-2026-109803EPSS 0.4%
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functio…
- 9.1CVE-2026-109798EPSS 0.3%
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access rest…
- 9.9CVE-2026-109795EPSS 0.4%
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to i…