The SAP November 2026 Patch Day fixes dozens of vulnerabilities across SAP’s product line, published on 10 November 2026. SAP posts its own advisories behind the SAP Support Portal, which needs a customer login, so this post cites NVD’s public per-CVE pages instead. We compare six vulnerabilities that NVD currently scores 9.0 or higher on CVSS 3.1, the common Critical cutoff.
What NVD Shows for the SAP November 2026 Patch Day
NVD lists 40 CVE records with cna@sap.com as the assigning authority, published on 10 November 2026. Nine of those records score 9.0 or higher on CVSS 3.1.
This post compares six of the nine in detail: CVE-2026-120017, CVE-2026-76965, CVE-2026-89119, CVE-2026-109795, CVE-2026-109803 and CVE-2026-109798. The other three, CVE-2026-76964, CVE-2026-89103 and CVE-2026-89126, also score 10.0. A seventh candidate, CVE-2026-109808 in the SAP Solution Tools Plug-In, scores 3.1 Low in the current NVD record, not Critical, so it is left out below.
The Six Critical Fixes in This Patch Day
| CVE | Component | CVSS 3.1 | Flaw Type | Fix Action |
|---|---|---|---|---|
| CVE-2026-120017 | NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) | 10.0 | Improper verification of an authentication assertion (CWE-347) | Apply SAP Note 3849308 |
| CVE-2026-76965 | NetWeaver Application Server ABAP and ABAP Platform | 9.9 | Missing authorization on an internal function (CWE-749) | Apply SAP Note 3792735 |
| CVE-2026-109795 | S4CRM, S4CEXT and BBPCRM (CRM components) | 9.9 | Missing authorization and code injection on a remote interface (CWE-94) | Apply SAP Note 3834842 |
| CVE-2026-109803 | NetWeaver Knowledge Management (XML Forms) | 9.9 | Unrestricted XSL transformation (CWE-94) | Apply SAP Note 3809153 |
| CVE-2026-89119 | Web Dispatcher and Internet Communication Manager | 9.6 | Cross-site request forgery in an admin function (CWE-352) | Apply SAP Note 3804858 |
| CVE-2026-109798 | BusinessObjects Business Intelligence Platform (Web Intelligence) | 9.1 | XML external entity injection (CWE-611) | Apply SAP Note 3799117 |
How to Read This Table
The CVSS column uses version 3.1. None of the six has a CVSS 4.0 score in NVD or in SAP’s own submission as CNA.
The Fix Action column names the SAP Note number that each NVD record cites. SAP Notes sit behind the SAP Support Portal and need a support login to open, so this post does not link individual notes.
Two Patterns Behind the Six Fixes
Three of the six (CVE-2026-120017, CVE-2026-76965 and CVE-2026-89119) sit in the ABAP application server or its Web Dispatcher front end, the components most SAP landscapes expose to a network. CVE-2026-120017 lets an unauthenticated caller forge an authentication assertion and impersonate any user, including an administrator, per NVD.
CVE-2026-76965 needs only a low-privileged account and reaches operating-system commands on the host, per NVD. CVE-2026-89119 needs a logged-on administrator to click a link, the record’s own description of a cross-site request forgery, and can still reach full operating-system compromise.
The other three (CVE-2026-109795, CVE-2026-109803 and CVE-2026-109798) sit in application-layer components: CRM extensions, Knowledge Management and the BusinessObjects BI platform. CVE-2026-109795 needs only a low-privileged account on a remote interface and leads to injected, executed code, per NVD.
CVE-2026-109803 needs an authenticated user with access to the affected function and lets an unauthorized XSL transformation run, which NVD says can execute code. CVE-2026-109798 needs an authenticated user too and lets an attacker read sensitive files on the server through an unrestricted XML entity reference, per NVD.
What NVD and CISA KEV Say About Exploitation
None of the six is in CISA’s Known Exploited Vulnerabilities catalog as of version 2026.11.09. NVD lists every one of the six as Received, meaning NVD’s own analysts have not yet added their enrichment to the CNA record.
What to Patch First
CVE-2026-120017 and CVE-2026-89119 need no valid account at all under the CVSS vectors NVD records, so patch the ABAP platform and Web Dispatcher front end first. CVE-2026-76965 and CVE-2026-109795 need only a low-privileged account, which many SAP landscapes already hand out widely.
CVE-2026-109803 and CVE-2026-109798 need an authenticated user with access to a specific function, a narrower population, but both still score above 9.0 and warrant the same patch cycle. Our patch management entry covers how to sequence a cycle like this one.
The Rest of This SAP Patch Day
SAP’s November 2026 Patch Day also fixes three other records NVD scores 10.0 that are not detailed here: CVE-2026-76964, CVE-2026-89103 and CVE-2026-89126. It also fixes roughly 30 more records that NVD scores under 9.0, and SAP’s own patch-day notes list every one of them.
We point to SAP’s own patch-day notes rather than cite them as a source, because the page sits behind the SAP Support Portal and needs a support login. Our own SAP NetWeaver Visual Composer upload flaw entry covers an earlier Critical NetWeaver CVE with the same pattern of wide exposure.
Frequently Asked Questions
Why does this post cite NVD instead of SAP's own advisories?
SAP publishes its Security Notes behind the SAP Support Portal, which needs a customer login. NVD publishes a public per-CVE page for each one, so we cite NVD.
How many CVEs does the SAP November 2026 Patch Day fix in total?
NVD lists 40 CVE records with SAP as the assigning authority, published on 10 November 2026. Nine score 9.0 or higher on CVSS 3.1.
Is CVE-2026-109808 Critical too?
No. NVD's current record scores CVE-2026-109808, in the SAP Solution Tools Plug-In, at 3.1 Low, so it is not in the comparison table.
Are any of these six SAP CVEs known to be exploited?
None of the six is in CISA's Known Exploited Vulnerabilities catalog as of version 2026.11.09, and NVD has not added exploitation status to any of the six records.
Which of the six needs no account at all to exploit?
CVE-2026-120017 and CVE-2026-89119, per the CVSS vectors in their NVD records. The other four need at least a low-privileged account.