SAP Security Note 3778530 addresses CVE-2026-76964, a critical vulnerability affecting SAP NetWeaver Application Server ABAP with the maximum CVSS score of 10.0. The vulnerability affects the Internet Communication Manager (ICM) and could allow an unauthenticated remote attacker to send specially crafted network traffic to an affected SAP system and potentially execute malicious code. Successful exploitation could result in a complete compromise of the system, affecting the confidentiality, integrity, and availability of business data and services. SAP NetWeaver Application Server Java is not affected. SAP has released corrections through updated SAP Kernel patch levels and recommends that customers apply the latest applicable SP Stack Kernel containing the fix, or use the available hotfix when immediate remediation is required. For environments where patching cannot be completed immediately, SAP also provides temporary mitigation options, including the use of an appropriately patched SAP Web Dispatcher when all affected traffic passes through it. Disabling WebSocket support is another possible workaround, although SAP advises that this can significantly affect applications and integrations. Given the vulnerability’s critical severity and the fact that exploitation does not require authentication or user interaction, organizations running affected SAP Kernel versions should prioritize reviewing and applying the corrections provided in the note.
SAP Security Note 3778556 addresses CVE-2026-89126, another critical vulnerability with the maximum CVSS score of 10.0, this time affecting SAP Web Dispatcher. The issue could enable an unauthenticated attacker to send malicious network traffic to a vulnerable Web Dispatcher and potentially take control of the affected system, putting sensitive data, system integrity, and availability at risk. Importantly, the vulnerability is not limited to standalone or embedded SAP Web Dispatcher installations; the Web Dispatcher used by SAP HANA Extended Application Services Classic Model (XSC) and Advanced Model (XSA) is also affected, while SAP Content Server is not impacted. SAP has released patches for affected Web Dispatcher and SAP Kernel versions and has also provided specific updates for SAP HANA XSC and XSA, with XSA environments requiring version 1.5.4 or higher.
SAP Security Note 3798345 addresses CVE-2026-89103, a critical access control vulnerability in SAP Gateway with the maximum CVSS score of 10.0. The issue relates to the default Access Control List (ACL), which can grant excessive trust and potentially cause an external attacker to be treated as an internal application server. An unauthenticated attacker with network access to SAP Gateway could exploit this weakness to perform unauthorized actions within the SAP environment, potentially resulting in a complete compromise of affected systems and serious impacts to sensitive data, system integrity, and availability. SAP has released a Kernel correction that strengthens the default access controls and, for Kernel releases up to and including 7.77, introduces the gw/acl_mode_proxy profile parameter to restrict the relevant default ACL rules. The parameter is available in Kernel releases 7.93 and later.
SAP Security Note 3849308 addresses CVE-2026-120017, a critical authentication vulnerability affecting the SAML 2.0 Service Provider in SAP NetWeaver AS ABAP and ABAP Platform, with the maximum CVSS score of 10.0. Under certain configurations, affected systems may not adequately verify incoming SAML authentication information, potentially allowing an unauthenticated attacker to bypass authentication and impersonate any ABAP user, including highly privileged accounts. Successful exploitation could give an attacker extensive control over the affected SAP system, with the potential impact extending to connected components and systems. SAP has corrected the issue by strengthening the verification of SAML authentication responses and advises customers to implement the Correction Instructions or Support Packages provided with the security note. There is no workaround available, making application of the SAP-provided correction especially important for organizations using SAML-based authentication on affected SAP NetWeaver AS ABAP and ABAP Platform releases.
SAP Security Note 3834842 addresses CVE-2026-109795, a critical authorization vulnerability affecting S4CRM and related SAP components, with a CVSS score of 9.9. The vulnerability is caused by missing authorization checks and insufficient validation of information submitted through certain remotely accessible functions. An attacker with only low-level privileges could exploit the issue by sending specially crafted input to execute unauthorized code within the affected SAP system. Successful exploitation could allow the attacker to expand their access beyond the vulnerable component, potentially exposing sensitive information, altering business data and disrupting system availability. SAP has addressed the vulnerability by introducing additional authorization checks and protections designed to identify and prevent the malicious input used to exploit the issue. Customers running affected S4CRM, S4CEXT, or BBPCRM versions should implement the correction instructions or applicable Support Package provided with the note.
SAP Security Note 3809153 addresses CVE-2026-109803, a critical code injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms) with a CVSS score of 9.9. The vulnerability could allow an authenticated user with access to XML Forms functionality to manipulate how certain transformations are processed and potentially execute unauthorized code within the application. Successful exploitation could expose sensitive information, allow unauthorized changes, and disrupt the availability of the affected environment. SAP has addressed the issue by limiting these transformations to those specifically configured for the relevant XML Forms project and rejecting unauthorized or unrecognized requests. Customers using the affected KMC-CM 7.50 component should implement the Support Packages and patches provided with the note. Until the correction can be applied, SAP recommends restricting access to XML Forms functionality to trusted users and reviewing permissions to ensure access follows the principle of least privilege.
SAP Security Note 3792735 addresses CVE-2026-76965, a critical OS command injection vulnerability affecting SAP NetWeaver Application Server ABAP and ABAP Platform, with a CVSS score of 9.9. The issue stems from insufficient authorization checks in functionality associated with SAPFTP, potentially allowing an attacker with relatively low privileges to execute unauthorized operating system commands on the server hosting the SAP environment. Successful exploitation could extend the attacker’s access beyond the SAP application itself, putting sensitive information, system integrity, and availability at significant risk. SAP has released corrections that restrict SAPFTP commands that are not required for normal file transfers and limit the local file locations those commands can access, with these protections enabled by default after the update is applied. Customers should implement the applicable Support Packages or Kernel patches provided with the note. Until patching can be completed, SAP recommends reviewing and removing the relevant S_RFC and S_C_FUNCT authorizations from users and roles that do not specifically require them, reducing the number of accounts capable of accessing the vulnerable functionality.
SAP Security Note 3805589 addresses CVE-2026-89107, a critical code injection vulnerability in SAP S/4HANA Manage Substitution/Validation Rules with a CVSS score of 9.9. The vulnerability could allow an authenticated attacker with the necessary business privileges to submit specially crafted rule information that is interpreted as executable ABAP code. Successful exploitation could enable arbitrary code execution and potentially lead to a complete compromise of the affected SAP S/4HANA system, putting sensitive business information, system integrity, and availability at risk. SAP has corrected the issue so that specially crafted input is no longer processed as executable ABAP code, and organizations running affected S4CORE versions 105 through 109 should apply the applicable correction for their release. As a temporary measure, customers can disable the OData service used by the Manage Substitution/Validation Rules application, although doing so prevents users from creating, changing, or deleting rules through the related SAP Fiori applications.
SAP Security Note 3804858 addresses CVE-2026-89119, a critical Cross-Site Request Forgery (CSRF) vulnerability affecting SAP Web Dispatcher and the Internet Communication Manager (ICM), with a CVSS score of 9.6. The vulnerability affects environments using the Web Dispatcher or ICM Administration UI and could allow an unauthenticated attacker to trick a logged-in administrator into visiting a malicious link. This could cause unauthorized actions to be performed using the administrator’s active session and, in the most serious scenario, lead to compromise of the underlying operating system. The note also addresses CVE-2026-120014, a related vulnerability affecting SAP HANA XSA Web Dispatcher, although with a lower CVSS score of 7.6 and more limited impact. SAP NetWeaver Application Server Java and the Web Dispatcher included with SAP HANA XSC are not affected. SAP has released patches for affected Web Dispatcher and Kernel versions, while SAP HANA XSA environments should be updated to version 1.5.5 or later. As a temporary mitigation, organizations can disable access to the Web Dispatcher/ICM Administration UI or remove the admin role from users and provide the more restricted monitor role instead.
SAP Security Note 3799117 addresses CVE-2026-109798, a critical XML External Entity (XXE) vulnerability affecting SAP BusinessObjects Business Intelligence Platform (Web Intelligence), with a CVSS score of 9.1. The vulnerability affects the processing of OLAP connection requests and could allow an authenticated attacker with relatively low privileges to gain access to resources that should normally be restricted. Successful exploitation could expose sensitive files stored on the server and allow the attacker to interact with internal systems that are not otherwise directly accessible, creating a significant risk to the confidentiality of the wider environment. SAP has addressed the vulnerability by strengthening XML processing controls and introducing stricter validation of OLAP connection information. Customers running affected SAP BusinessObjects Business Intelligence Platform releases should implement the Support Packages and patches provided with the note.
SAP Security Note 3846599 addresses two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP-based applications running on SAP BTP Cloud Foundry and Kyma environments. Collectively known as the PHP2Shell attack chain, the vulnerabilities affect unpatched PHP 8.x versions and carry a CVSS score of 9.8. An unauthenticated remote attacker could exploit the vulnerabilities without user interaction and potentially execute malicious code within an affected application, leading to unauthorized access to sensitive information, application changes, or disruption of services. Applications using the SAP BTP Cloud Foundry PHP system buildpack should be restaged to obtain the patched PHP versions included with buildpack 5.1.4, while Docker and SAP BTP Kyma workloads should be rebuilt and redeployed using PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 or later within the corresponding release line.