SAP Security Patch Day – November 2026
Chapters
Share Article
Let's Talk SAP Security
Have questions about SAP Security? We’re here to help. Whether you need insights, solutions, or a tailored security strategy, we’re ready to chat. Contact Us
SAP has released 35 new and 3 updated Security Notes, plus 4 GitHub security advisories for SAP open-source libraries today. Together with the 5 notes released since the last Patch Day, this brings the total to 47 Security Notes and advisories to review in this November patch cycle. Never before have so many SAP Security Notes been released in a single patch cycle! A clear indication of what we can expect from SAP Security in the AI era.
Always remember: many successful attacks exploit vulnerabilities for which patches are already available. Applying security patches as quickly as possible remains one of the most effective ways to reduce exposure to known vulnerabilities and limit the attack surface across SAP landscapes.
The SecurityBridge Patch Management for SAP solution helps organizations identify missing patches across their SAP landscape, providing clear visibility, impact analysis, and automated implementation support. By offering a system-wide overview, it helps accelerate patching cycles and strengthen continuous threat monitoring, contributing to a more secure and resilient SAP environment throughout 2026.
Highlights
The November patch cycle contains an unusually high number of critical notes: 12 HotNews and 13 High, with four times as many HotNews as in October. With 41 notes for on-premise systems and 2 for SAP Business AI Platform in the cloud, plus 4 GitHub advisories for SAP’s open-source libraries, this is mainly an on-premise month. Much of the work overlaps: a single kernel update can be combined to fix multiple vulnerabilities. Only 5 notes come with manual activities, and 15 offer a workaround for systems that cannot be patched right away.
As always, start with the HotNews and High priority notes, and combine work where you can.
The full breakdown follows below.
SAP Security Notes November 2026
Summary by Severity
The November release contains a total of 47 patches* with the following severities:
* Including updates, in-between releases and GitHub security advisories
Component overview
Where this month's risk concentrates: the number of Security Notes per component area and priority.
Security Notes - Overview
Below are all 43 Security Notes and 4 GitHub security advisories of this Patch Day, sorted by CVSS score.
• Workaround shows whether the note offers a temporary mitigation for systems that cannot be patched right away.
• Manual activity shows whether implementing the note takes more than applying the patch, such as configuration steps.
| Note | Description | Severity | CVSS | Workaround | Manual activity |
|---|---|---|---|---|---|
| 3778530 | [CVE-2026-76964] Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager) Released on: 11/10/26 Components: BC-CST-IC Category: Program error | HotNews | 10.0 | Yes | No |
| 3778556 | [CVE-2026-89126] Memory Corruption vulnerability in SAP Web Dispatcher Released on: 11/10/26 Components: BC-CST-WDP Category: Program error | HotNews | 10.0 | Yes | No |
| 3798345 | [CVE-2026-89103] Broken Access Control in SAP Gateway Released on: 11/10/26 Components: BC-CST-GW Category: Program error | HotNews | 10.0 | No | Yes |
| 3849308 | [CVE-2026-120017] Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) Released on: 11/10/26 Components: BC-SEC-LGN-SML Category: Program error | HotNews | 10.0 | No | No |
| 3792735 | [CVE-2026-76965] OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform Released on: 11/10/26 Components: BC-SRV-COM-FTP Category: Program error | HotNews | 9.9 | Yes | No |
| 3805589 | [CVE-2026-89107] Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) Released on: 11/6/26 Components: FI-SL-VSR Category: Program error | HotNews | 9.9 | Yes | No |
| 3809153 | [CVE-2026-109803] Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms) Released on: 11/10/26 Components: EP-KM-CM Category: Program error | HotNews | 9.9 | Yes | No |
| 3834842 | [CVE-2026-109795] Missing authorization check in S4CRM Released on: 11/10/26 Components: CRM-BF-SVY Category: Program error | HotNews | 9.9 | No | Yes |
| 3843368 | [CVE-2026-111497] Memory Corruption in Node.js Brotli decoder affecting SAP Business AI Platform Released on: 10/29/26 Components: BC-CP-SEC-VUL Category: Program error | HotNews | 9.8 | Yes | No |
| 3846599 | [Multiple CVEs] Remote Code Execution vulnerability in PHP affecting SAP Business AI Platform Released on: 11/5/26 Components: BC-CP-CF-BLDP Category: Program error | HotNews | 9.8 | No | No |
| 3804858 | [CVE-2026-89119] Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager Released on: 11/10/26 Components: BC-CST-WDP Category: Program error | HotNews | 9.6 | Yes | No |
| 3799117 | [CVE-2026-109798] XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Released on: 11/10/26 Components: BI-BIP-SL Category: Program error | HotNews | 9.1 | No | No |
| 3769130 | [CVE-2026-76966] Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform Released on: 11/10/26 Components: BC-MID-RFC Category: Program error | High | 8.9 | No | No |
| 3809953 | [CVE-2026-120008] Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service) Released on: 11/10/26 Components: BC-FES-IGS Category: Program error | High | 8.2 | No | No |
| 3803832 | [CVE-2026-109800] Memory Corruption vulnerability in SAP Web Dispatcher Released on: 11/10/26 Components: BC-CST-WDP Category: Program error | High | 7.7 | No | No |
| 3789273 | [CVE-2026-76973] Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server) Released on: 11/10/26 Components: BC-CST-MS Category: Program error | High | 7.5 | No | No |
| 3792915 | [CVE-2026-76970] Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform Released on: 11/10/26 Components: BC-ABA-SC Category: Program error | High | 7.5 | No | No |
| 3805570 | [CVE-2026-120010] Memory Corruption vulnerability in SAP NetWeaver Application Server (SAP Message Server) Released on: 11/10/26 Components: BC-CST-MS Category: Program error | High | 7.5 | No | No |
| 3805681 | [CVE-2026-109794] Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher Released on: 11/10/26 Components: BC-CST-IC Category: Program error | High | 7.5 | Yes | No |
| 3808552 | [CVE-2026-109804] Information Disclosure in SAP NetWeaver (SAP Message Server) Released on: 11/10/26 Components: BC-CST-MS Category: Program error | High | 7.5 | No | No |
| 3808627 | [CVE-2026-109793] Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher Released on: 11/10/26 Components: BC-CST-DP Category: Program error | High | 7.5 | No | No |
| 3809934 | [Multiple CVEs] Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service) Released on: 11/10/26 Components: BC-FES-IGS Category: Program error | High | 7.5 | No | No |
| 3810485 | [CVE-2026-89114] Missing Authentication check in SAP NetWeaver AS Java EDM Application Released on: 11/10/26 Components: BC-DWB-JAV-J2E Category: Program error | High | 7.5 | Yes | No |
| 3842766 | [CVE-2026-120015] Insufficient Input Validation in SAP Host Agent Released on: 11/10/26 Components: BC-CCM-HAG Category: Program error | High | 7.5 | No | No |
| GHSA-28c8- 457r-4cf6 | [CVE-2026-120013] Path Traversal in Agent Memory Module of SAP Cloud SDK for Python Released on: 11/10/26 Library: SAP Cloud SDK for Python (pip: sap-cloud-sdk), fixed in 0.50.0 Category: GitHub security advisory | High | 7.5 | Yes | No |
| GHSA-8g7j- 49xg-8wf3 | [CVE-2026-120012] Information Disclosure vulnerability in SAP Cloud SDK for AI (JavaScript) Released on: 11/10/26 Library: SAP Cloud SDK for AI (JavaScript) (npm: @sap-ai-sdk/ai-api), fixed in 2.18.0 Category: GitHub security advisory | High | 7.5 | No | No |
| GHSA-93m8- crj2-v997 | [CVE-2026-109799] Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip)) Released on: 11/10/26 Library: SAP Cloud SDK for Python (pip: sap-cloud-sdk), fixed in 0.63.1 Category: GitHub security advisory | High | 7.5 | Yes | No |
| 3833364 | [CVE-2026-120009] Code Injection vulnerability in SAP ABAP Developer Tools (AMDP Data Preview) Released on: 11/10/26 Components: BC-DWB-AIE-DP Category: Program error | High | 7.2 | Yes | No |
| GHSA-93c9- 96j8-4vg9 | [CVE-2026-109797] Cross-tenant sandbox takeover in SAP/astonish Released on: 11/10/26 Library: SAP/astonish (go), fixed in v3.6.0 Category: GitHub security advisory | High | 7.1 | No | No |
| 3756450 | [CVE-2026-44766] - SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation) Released on: 10/27/26 Components: FIN-CS-ICR Category: Program error | Medium | 6.5 | Yes | No |
| 3793716 | [CVE-2026-109802] Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server for ABAP Released on: 11/10/26 Components: BC-MID-RFC Category: Program error | Medium | 6.5 | No | No |
| 3805959 | [CVE-2026-109811] Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) Released on: 11/10/26 Components: BC-MID-ICF Category: Program error | Medium | 6.5 | No | Yes |
| 3839977 | [Multiple CVEs] Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit) Released on: 11/10/26 Components: BC-CTS-DI Category: Program error | Medium | 6.5 | No | No |
| 3703856 | [CVE-2026-24309] Missing Authorization check in SAP NetWeaver Application Server for ABAP Released on: 10/27/26 Components: BC-DB-ORA-CCM Category: Program error | Medium | 6.4 | No | No |
| 3786876 | [CVE-2026-109805] Weak Cryptography in SAP NetWeaver and ABAP Platform (Application Server ABAP) Released on: 11/10/26 Components: BC-MID-RFC Category: Program error | Medium | 6.4 | No | No |
| 3797108 | [CVE-2026-109810] CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) Released on: 11/10/26 Components: BC-WD-JAV Category: Program error | Medium | 6.1 | No | No |
| 3806484 | [CVE-2026-120016] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Visual Composer Released on: 11/10/26 Components: EP-VC-RTM Category: Program error | Medium | 6.1 | No | No |
| 3782056 | [CVE-2026-89125] Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager Released on: 11/10/26 Components: BC-CST-WDP Category: Program error | Medium | 6.0 | No | Yes |
| 3835738 | [CVE-2026-89129] Server-Side Request Forgery in SAP NetWeaver AS Java (Web Services) Released on: 11/10/26 Components: BC-JAS-SEC-WSS Category: Program error | Medium | 5.8 | Yes | No |
| 3671819 | [CVE-2026-76976] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) Released on: 11/10/26 Components: BC-FES-CTL Category: Program error | Medium | 5.4 | No | No |
| 3792447 | [CVE-2026-89128] Broken Access Control in SAP NetWeaver Process Integration (Process Integration Test Tool) Released on: 11/10/26 Components: BC-XI-PIT Category: Program error | Medium | 5.3 | No | No |
| 3803144 | [CVE-2026-73635] Denial of service (DoS) in SAP Business Objects Released on: 11/10/26 Components: BI-BIP-CMC Category: Program error | Medium | 5.3 | No | No |
| 3740168 | [CVE-2026-89115] Information Disclosure vulnerability in SAP Start Service and SAP Microsoft Management Console Released on: 11/10/26 Components: BC-CST-STS Category: Program error | Medium | 4.4 | Yes | No |
| 3801587 | [CVE-2026-89131] Cross Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Enterprise Portal Released on: 11/10/26 Components: EP-PIN-NAV Category: Program error | Medium | 4.3 | No | No |
| 3101986 | Prepare CSP support for On-Premise down port for code dependency in SAP WebClient UI Released on: 11/10/26 Components: CA-WUI-UI Category: Program error | Medium | 4.1 | No | Yes |
| 3155685 | [CVE-2026-44768] Security misconfiguration in SAP WebClient UI Released on: 11/10/26 Components: CA-WUI-UI Category: Program error | Medium | 4.1 | No | No |
| 3802244 | [CVE-2026-109808] Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI) Released on: 11/10/26 Components: SV-SMG-SDD Category: Program error | Low | 3.1 | No | No |
