Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-ea98c8be72Early warningVulnerabilityReported, not confirmed

SAP patches four CVSS 10.0 flaws in NetWeaver and Web Dispatcher

SAP fixed four flaws rated 10.0, the maximum CVSS score, as part of its monthly Security Patch Day. Three affect the NetWeaver application server and one affects the Web Dispatcher, which handles internet-facing web requests; attackers could exploit them without logging in.

Written by a model from the sources below. Verify against them.

Sources5Reported, not confirmed
Kind
Vulnerability
Vendor
SAP
Product
SAP Web Dispatcher and Internet Communication Manager
Status
Reported, not confirmed
First seen

What to do

  • Apply SAP's latest Security Patch Day updates to NetWeaver and Web Dispatcher now

  • Prioritize internet-exposed Web Dispatcher and NetWeaver instances

  • Review systems for signs of unauthorized access until patched

  • Apply SAP's November 2026 security updates to NetWeaver, Web Dispatcher, and Gateway

  • Prioritize the four maximum-severity fixes

  • Check whether these SAP components are exposed to untrusted networks

Timeline

  1. Made public by Mastodon
  2. First seen by cve.now

Evidence 5

  1. Social
    Mastodon
    “SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manage...”
    +7 more: Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon
  2. Social
    Mastodon
    “SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component.”
  3. Press
    The Hacker News
    “Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.”
  4. Press
    BleepingComputer
    “SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software.”
    +1 more: BleepingComputer on Bluesky
  5. Press
    SecurityWeek
    “SAP has published 42 new and updated security advisories, including nine that address critical-severity vulnerabilities.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-ea98c8be72

Has SAP confirmed it?

Mastodon, Mastodon and The Hacker News report it. No statement from SAP has reached cve.now yet.Source: Mastodon, Mastodon, The Hacker News, BleepingComputer, SecurityWeek

What should SAP users do?

Apply SAP's latest Security Patch Day updates to NetWeaver and Web Dispatcher now. Prioritize internet-exposed Web Dispatcher and NetWeaver instances. Review systems for signs of unauthorized access until patched. Apply SAP's November 2026 security updates to NetWeaver, Web Dispatcher, and Gateway. Prioritize the four maximum-severity fixes. Check whether these SAP components are exposed to untrusted networks.

Sources