# SAP Patches Dozens of Flaws Across NetWeaver Stack

Published: 2026-11-10 · Severity: routine
Canonical: https://vorant.io/reports/6cafa86e-44ba-5e7c-af38-eaea8f76c29a/sap-patches-dozens-of-flaws-across-netweaver-stack
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> SAP released fixes for over 40 vulnerabilities across NetWeaver, Web Dispatcher, Gateway, and Cloud SDK; no in-the-wild exploitation reported.

Source: cisecurity.org — https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sap-products-could-allow-for-arbitrary-code-execution_2026-128

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CISA/MS-ISAC advisory 2026-128 summarizes SAP's latest patch release covering a broad set of SAP products including NetWeaver AS ABAP and Java, Web Dispatcher, Gateway, ABAP Developer Tools, S4CRM, BusinessObjects BI, Cloud SDK for Python and JavaScript, and SAP/astonish. The most severe issues are memory corruption and code/OS command injection flaws that could allow an unauthenticated or low-privileged attacker to achieve arbitrary code execution and fully compromise affected systems, with high impact to confidentiality, integrity, and availability. Other notable issues include missing authentication on the SAML2 Service Provider, a JWT signature verification flaw in the Cloud SDK's IASContextProvider enabling tenant/user identity spoofing, a cross-tenant sandbox takeover in SAP/astonish, SSRF, path traversal, XXE, and multiple CSRF and access-control weaknesses spanning NetWeaver components.

No exploitation in the wild has been reported for any of these CVEs at the time of publication. Given SAP NetWeaver's role as a widely deployed, internet-facing ERP platform, the advisory recommends prompt patching after testing, vulnerability scanning, network segmentation (placing internet-facing SAP components in a DMZ), least-privilege configuration, and regular penetration testing. Defenders should prioritize patching the memory corruption, OS command injection, missing authentication, and identity-spoofing issues given their potential for remote code execution or authentication bypass against exposed SAP Gateway, ICM, Web Dispatcher, and Cloud SDK components.

This is a routine, vendor-driven patch cycle rather than an active campaign; the Threat Intelligence section explicitly notes no known exploitation. Organizations running any of the listed SAP Kernel, SAP_BASIS, or Cloud SDK versions should apply SAP's official patches as part of standard monthly patch management.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109793, CVE-2026-109794, CVE-2026-109795, CVE-2026-109796, CVE-2026-109797, CVE-2026-109798, CVE-2026-109799, CVE-2026-109800, CVE-2026-109801, CVE-2026-109802, CVE-2026-109803, CVE-2026-109804, CVE-2026-109805, CVE-2026-109806, CVE-2026-109807, CVE-2026-109808, CVE-2026-109809, CVE-2026-109811, CVE-2026-120008, CVE-2026-120009, CVE-2026-120010, CVE-2026-120012, CVE-2026-120013, CVE-2026-120014, CVE-2026-120015, CVE-2026-120017, CVE-2026-73635, CVE-2026-76964, CVE-2026-76965, CVE-2026-76966, CVE-2026-76970, CVE-2026-76973, CVE-2026-89103, CVE-2026-89114, CVE-2026-89119, CVE-2026-89125, CVE-2026-89126, CVE-2026-89128, CVE-2026-89129, CVE-2026-89131

## Detection guidance (public sample)

### SAP NetWeaver Server Process Spawning Shell or LOLBin on Windows

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

SAP ABAP/Java/Web Dispatcher/Gateway server processes spawning command interpreters or download/execution LOLBins, which is typical of OS command injection or RCE exploitation of an exposed SAP service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SAP NetWeaver Server Process Spawning Shell or LOLBin on Windows
id: b6620602-2d8e-509d-ad18-d1532ef2f763
status: experimental
description: Detects SAP NetWeaver server processes (ABAP dispatcher work process,
  Java server node, Web Dispatcher, ICM, Gateway) spawning command interpreters or
  common download/execution binaries. This is consistent with OS command injection
  or memory-corruption RCE against internet-facing SAP components. Generalises on
  the parent/child relation and does not rely on specific CVEs.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \disp+work.exe
    - \jstart.exe
    - \sapwebdisp.exe
    - \gwrd.exe
    - \icman.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
    - \regsvr32.exe
    - \rundll32.exe
  condition: selection
falsepositives:
- SAP administrators running external OS commands defined in transaction SM69 or SM49
- Custom SAP batch jobs that call cmd.exe scripts
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sap-products-could-allow-for-arbitrary-code-execution_2026-128
```

### SAP NetWeaver Server Process Spawning Shell or Downloader on Linux

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

SAP dispatcher, Java server node, Web Dispatcher, ICM or Gateway processes spawning shells or download/netcat utilities on Linux, indicating possible command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SAP NetWeaver Server Process Spawning Shell or Downloader on Linux
id: 9d876806-487f-5281-918d-28c61611738f
status: experimental
description: Detects SAP NetWeaver server processes on Linux (disp+work, jstart, sapwebdisp,
  gwrd, icman) spawning shells or network download/transfer utilities. Consistent
  with OS command injection or RCE against exposed SAP services. Legitimate SM69 external
  commands can overlap, so tune for known commands.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /disp+work
    - /jstart
    - /sapwebdisp
    - /gwrd
    - /icman
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /curl
    - /wget
    - /nc
    - /ncat
    - /python
    - /python3
    - /perl
  condition: selection
falsepositives:
- External OS commands configured in SM69 that intentionally run shell scripts
- SAP housekeeping jobs invoking shell wrappers
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sap-products-could-allow-for-arbitrary-code-execution_2026-128
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sap-products-could-allow-for-arbitrary-code-execution_2026-128

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6cafa86e-44ba-5e7c-af38-eaea8f76c29a/sap-patches-dozens-of-flaws-across-netweaver-stack.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup