# SZB-ea98c8be72: SAP patches four CVSS 10.0 flaws in NetWeaver and Web Dispatcher

SAP fixed four flaws rated 10.0, the maximum CVSS score, as part of its monthly Security Patch Day. Three affect the NetWeaver application server and one affects the Web Dispatcher, which handles internet-facing web requests; attackers could exploit them without logging in.

- Type: Early warning
- Kind: Vulnerability
- Vendor: SAP
- Product: SAP Web Dispatcher and Internet Communication Manager
- Status: Reported, not confirmed
- Sources: 5 distinct
- First seen: 2026-11-10 01:02 UTC

> No statement or filing from SAP has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## What to do

- Apply SAP's latest Security Patch Day updates to NetWeaver and Web Dispatcher now
- Prioritize internet-exposed Web Dispatcher and NetWeaver instances
- Review systems for signs of unauthorized access until patched
- Apply SAP's November 2026 security updates to NetWeaver, Web Dispatcher, and Gateway
- Prioritize the four maximum-severity fixes
- Check whether these SAP components are exposed to untrusted networks

## Timeline

- 2026-11-10 01:01 UTC: Made public by Mastodon
- 2026-11-10 01:02 UTC: First seen by cve.now

## Evidence (5 sources)

- 2026-11-10 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117589440355088058): “SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manage...” (+7 more: [Mastodon](https://mastodon.social/@thehackerwire/117589560432800524), [Mastodon](https://mastodon.social/@EUVD_Bot/117589672518229964), [Mastodon](https://mastodon.social/@EUVD_Bot/117589672723160417), [Mastodon](https://mastodon.social/@EUVD_Bot/117589680318224674), [Mastodon](https://mastodon.social/@EUVD_Bot/117589680438596248), [Mastodon](https://mastodon.social/@EUVD_Bot/117589684183319665), [Mastodon](https://mastodon.social/@EUVD_Bot/117589684282134565))
- 2026-11-10 · Social · [Mastodon](https://mastodon.social/@thehackerwire/117589561020064814): “SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component.”
- 2026-11-10 · Press · [The Hacker News](https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html): “Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.”
- 2026-11-10 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/sap-patches-four-maximum-severity-security-vulnerabilities/): “SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzxfpzlokb2l))
- 2026-11-10 · Press · [SecurityWeek](https://www.securityweek.com/sap-patches-critical-icm2shell-proxygate-vulnerabilities/): “SAP has published 42 new and updated security advisories, including nine that address critical-severity vulnerabilities.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-ea98c8be72&body=https%3A%2F%2Fcve.now%2FSZB-ea98c8be72%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-ea98c8be72

### Has SAP confirmed it?

Mastodon, Mastodon and The Hacker News report it. No statement from SAP has reached cve.now yet.

Source: https://mastodon.social/@EUVD_Bot/117589440355088058, https://mastodon.social/@thehackerwire/117589561020064814, https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html, https://www.bleepingcomputer.com/news/security/sap-patches-four-maximum-severity-security-vulnerabilities/, https://www.securityweek.com/sap-patches-critical-icm2shell-proxygate-vulnerabilities/

### What should SAP users do?

Apply SAP's latest Security Patch Day updates to NetWeaver and Web Dispatcher now. Prioritize internet-exposed Web Dispatcher and NetWeaver instances. Review systems for signs of unauthorized access until patched. Apply SAP's November 2026 security updates to NetWeaver, Web Dispatcher, and Gateway. Prioritize the four maximum-severity fixes. Check whether these SAP components are exposed to untrusted networks.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-ea98c8be72
Site guide for agents: https://cve.now/llms.txt