SAP's November fixes reach beyond its critical servers
On day two, SAP's November bulletin expanded from four critical NetWeaver, Web Dispatcher and Gateway flaws to 35 new security notes across additional products, including Knowledge Management and BusinessObjects. NCSC-NL's November 12 advisory lists fixes spanning 45 CVEs and components from ABAP and Java servers to BusinessObjects, Cloud SDK and Host Agent.
The notes cover different weaknesses, not one exploit chain. In one critical flaw in SAP NetWeaver Application Server ABAP, the system can accept certain incoming login statements without properly checking them. Where that authentication path is used, a forged statement can be treated as a genuine login, enabling unauthorized access.
For SAP estates that run services separately—or embed Web Dispatcher in HANA XS Classic or XS Advanced—a check of standalone NetWeaver systems can miss other affected components. The wider bulletin makes the exposure an inventory problem across the SAP estate, not a single-server issue.
CVEs in this update
45 CVEs
Across SAP WebClient UI, SAP NetWeaver AS ABAP (Internet Communication Manager), SAP Gateway, and related packages.
SAP heeft meerdere kwetsbaarheden verholpen in diverse SAP-producten, waaronder SAP NetWeaver Application Server ABAP, SAP NetWeaver AS Java, SAP Web Dispatcher, SAP BusinessObjects Business Intelligence Platform, SAP Cloud SDK, SAP Host Agent, SAP NetWeaver Enterprise Portal, SAP NetWeaver Visual Composer, en SAP Solution Tools Plug-In.
Nell’ambito del Security Patch Day di novembre, SAP rilascia aggiornamenti di sicurezza per risolvere 42 nuove vulnerabilità, di cui 9 con gravità “critica” e 19 con gravità “alta”.
SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software.