SAP Security Patch Day November 2026 · 10 November 2026 · RedRays
November is a heavy month. SAP released 38 security notes on Patch Day, nine of them HotNews, and four of those score the maximum CVSS 10.0. None of the four needs credentials: a SAML2 signature bypass in AS ABAP, a weakness in SAP Gateway’s default access control list, and a WebSocket heap overflow that hits both SAP Web Dispatcher and the ABAP ICM. For the SAP Security Patch Day November 2026, most of the critical fixes are in the kernel, so the practical answer for many landscapes is one well-planned kernel and Web Dispatcher rollout.
Our review of SAP for Me on 10 November found 38 notes with that release date: nine HotNews, thirteen High, fifteen Medium and one Low. Thirty-five are new and three are revisions of older notes. Since the October Patch Day, SAP also published two out-of-band HotNews for SAP BTP runtimes (PHP and Node.js) and revised three existing notes. The table below lists all of them.
SAP Security Patch Day November 2026: the CVSS 10.0 issues to assess first
AS ABAP SAML2 — Note 3849308, CVE-2026-120017. Under certain configurations the SAML2 service provider did not verify signatures on incoming assertions, so an attacker could forge a response and log on as any user, administrators included. Therefore, check every Fiori or Web GUI system with SAML SSO. There is no workaround.
SAP Gateway — Note 3798345, CVE-2026-89103. The default ACL could classify an external attacker as an internal application server, which opens the classic Gateway paths to command execution. The kernel fix adds gw/acl_mode_proxy for kernels up to 7.77. Make sure secinfo and reginfo hold explicit rules.
Web Dispatcher and ICM WebSocket — Note 3778556, CVE-2026-89126 and Note 3778530, CVE-2026-76964. Malformed WebSocket control frames cause a heap out-of-bounds write before authentication. In addition, the bug reaches Web Dispatchers in HANA XS Classic and Advanced. Disabling WebSocket is possible but breaks features, so patch.
The other HotNews
Three CVSS 9.9 issues from Patch Day November 2026 need an authenticated user. SAPFTP over RFC lets a low-privileged ABAP user run OS commands; removing S_RFC for function group SFTP is a good interim step. S4CRM and SAP CRM have a remote-enabled function without authorization checks that allows XSLT injection. Knowledge Management XML Forms on the portal processes a request-selected XSL transformation.
CSRF in the Web Dispatcher and ICM administration UI (9.6) only applies where icm/HTTP/admin parameters exist and someone has the admin role, but then a single click by an administrator can lead to OS compromise. XXE in BusinessObjects Web Intelligence (9.1) lets an authenticated user read server files and reach internal systems through OLAP connections. Together, these make the HotNews list of Patch Day November 2026 unusually long.
Kernel and Web Dispatcher: one rollout, many notes
Seventeen of the Patch Day November 2026 fixes live in the SAP kernel, the standalone Web Dispatcher or both. Besides the HotNews above, they include three Message Server bugs (3789273, 3805570, 3808552), unauthenticated RFC memory corruption (3769130, CVSS 8.9) and several denial-of-service issues in ICM and Web Dispatcher. The IGS fixes (3809953, 3809934) come as a separate IGS patch. If you can only do one thing this month, update the kernel and every Web Dispatcher to levels that cover all of them.
Two Patch Day November 2026 notes need follow-up work beyond the patch. After Note 3782056, existing ICM and Web Dispatcher admin users keep their old password hashes until reset. Note 3797108 changes Web Dynpro Java theme loading to the current host by default, which can break custom theme setups. Note 3805681 has a cheap workaround if the patch has to wait: set ict/disable_brotli = TRUE.
SAP BTP: restage your apps
Ahead of Patch Day November 2026, SAP published Note 3843368 for a Brotli decoder out-of-bounds write reachable through Node.js, and Note 3846599 for the php2shell RCE chain in PHP. Both are CVSS 9.8. SAP has rolled out fixed buildpacks on Cloud Foundry, but running applications only pick them up after cf restage. Docker and Kyma workloads need rebuilt images and a rollout.
SAP Security Patch Day November 2026: all notes released or revised since October
Select a CVE below for our individual analysis. SAP Note links open the original advisory.
Patch Day November 2026: HotNews notes
The first table lists the HotNews notes of Patch Day November 2026, including the two out-of-band BTP notes.
| SAP Note | CVE | Issue | CVSS | Release type |
|---|---|---|---|---|
| 3778530 | CVE-2026-76964 | ICM WebSocket memory corruption | 10.0 | New, HotNews |
| 3778556 | CVE-2026-89126 | Web Dispatcher memory corruption | 10.0 | New, HotNews |
| 3798345 | CVE-2026-89103 | SAP Gateway access control | 10.0 | New, HotNews |
| 3849308 | CVE-2026-120017 | SAML2 Authentication bypass | 10.0 | New, HotNews |
| 3792735 | CVE-2026-76965 | SAPFTP command injection | 9.9 | New, HotNews |
| 3809153 | CVE-2026-109803 | KM XML Forms code injection | 9.9 | New, HotNews |
| 3834842 | CVE-2026-109795 | S4CRM xslt injection | 9.9 | New, HotNews |
| 3843368 | CVE-2026-111497 | Node.js Brotli memory corruption | 9.8 | Out of band (29 Oct) |
| 3846599 | CVE-2026-109618, CVE-2026-109619 | PHP on SAP BTP remote code execution | 9.8 | Out of band (5 Nov) |
| 3804858 | CVE-2026-89119 | Web Dispatcher admin csrf | 9.6 | New, HotNews |
| 3799117 | CVE-2026-109798 | BusinessObjects xxe | 9.1 | New, HotNews |
Patch Day November 2026: High priority notes
Next, the High notes of Patch Day November 2026 are mostly kernel, Web Dispatcher, IGS and AS Java fixes.
| SAP Note | CVE | Issue | CVSS | Release type |
|---|---|---|---|---|
| 3769130 | CVE-2026-76966, CVE-2026-109796 | RFC Protocol memory corruption | 8.9 | New, High |
| 3809953 | CVE-2026-120008 | Internet Graphics Service memory corruption | 8.2 | New, High |
| 3803832 | CVE-2026-109800 | Web Dispatcher process crash | 7.7 | New, High |
| 3789273 | CVE-2026-76973 | Message Server memory corruption | 7.5 | New, High |
| 3792915 | CVE-2026-76970 | AS ABAP Parser memory corruption | 7.5 | New, High |
| 3805570 | CVE-2026-120010 | Message Server heap overflow | 7.5 | New, High |
| 3805681 | CVE-2026-109794 | ICM Resource exhaustion | 7.5 | New, High |
| 3808552 | CVE-2026-109804 | Message Server information disclosure | 7.5 | New, High |
| 3808627 | CVE-2026-109793 | ICM Header Parsing denial of service | 7.5 | New, High |
| 3809934 | CVE-2026-109807, CVE-2026-109806 | Internet Graphics Service denial of service | 7.5 | New, High |
| 3810485 | CVE-2026-89114 | AS Java EDM missing authentication | 7.5 | New, High |
| 3842766 | CVE-2026-120015 | SAP Host Agent input validation | 7.5 | New, High |
| 3833364 | CVE-2026-120009 | ADT AMDP Preview code injection | 7.2 | New, High |
Patch Day November 2026: Medium and Low notes
Next, the Medium and Low notes of Patch Day November 2026 mostly need a standard support package or kernel update.
| SAP Note | CVE | Issue | CVSS | Release type |
|---|---|---|---|---|
| 3793716 | CVE-2026-109802 | ABAP RFC denial of service | 6.5 | New, Medium |
| 3805959 | CVE-2026-109811 | AS ABAP server-side request forgery | 6.5 | New, Medium |
| 3839977 | CVE-2026-109801, CVE-2026-109809 | NWDI Cockpit access control | 6.5 | New, Medium |
| 3786876 | CVE-2026-109805 | RFC Callback weak cryptography | 6.4 | New, Medium |
| 3797108 | CVE-2026-109810 | Web Dynpro Java css injection | 6.1 | New, Medium |
| 3806484 | CVE-2026-120016 | Visual Composer reflected xss | 6.1 | New, Medium |
| 3782056 | CVE-2026-89125 | ICM Password storage | 6.0 | New, Medium |
| 3835738 | CVE-2026-89129 | AS Java WS-Addressing ssrf | 5.8 | New, Medium |
| 3792447 | CVE-2026-89128 | PI Test Tool access control | 5.3 | New, Medium |
| 3803144 | CVE-2026-73635 | BusinessObjects denial of service | 5.3 | New, Medium |
| 3740168 | CVE-2026-89115 | SAP Start Service credential exposure | 4.4 | New, Medium |
| 3801587 | CVE-2026-89131 | Enterprise Portal csrf | 4.3 | New, Medium |
| 3802244 | CVE-2026-109808 | ST-PI missing authorization | 3.1 | New, Low |
Revised notes
Finally, SAP also revised several older notes around Patch Day November 2026. So check whether you implemented an earlier version.
| SAP Note | CVE | Issue | CVSS | Release type |
|---|---|---|---|---|
| 3671819 | CVE-2026-76976 | SAP GUI for HTML XSS: new correction instructions (v18) | 5.4 | Update |
| 3155685 | CVE-2026-44768 | WebClient UI missing CSP: title and symptom reworded | 4.1 | Update |
| 3101986 | – | WebClient UI CSP prerequisite: title and symptom reworded | 4.1 | Update |
| 3805589 | CVE-2026-89107 | S/4HANA rule code injection: correction for S4CORE 106 (6 Nov) | 9.9 | Update |
| 3756450 | CVE-2026-44766 | S/4HANA ICMR SQL injection: correction instructions (27 Oct) | 6.5 | Update |
| 3703856 | CVE-2026-24309 | ABAP missing authorization check: correction instructions (27 Oct) | 6.4 | Update |
Source: SAP for Me, SAP Security Notes for Patch Day November 2026, reviewed on 10 November 2026. Note versions change after release, so check the current version of each note before you plan.
