# SAP patches 44 flaws across NetWeaver products

Published: 2026-11-12 · Severity: routine
Canonical: https://vorant.io/reports/e9390659-3283-51c0-b5b7-f9ebe2604490/sap-patches-44-flaws-across-netweaver-products
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> NCSC-NL advisory details 44 SAP vulnerabilities, including four with maximum CVSS 10.0, affecting NetWeaver AS ABAP/Java and related components.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0485.html

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

The Dutch National Cyber Security Center published an advisory consolidating SAP's latest security patches, covering 44 CVEs across SAP NetWeaver Application Server ABAP, NetWeaver AS Java, SAP Web Dispatcher, BusinessObjects Business Intelligence Platform, Cloud SDK, Host Agent, NetWeaver Enterprise Portal, NetWeaver Visual Composer, and Solution Tools Plug-In. The flaws span a wide range of weakness classes including OS command injection, memory corruption (stack/heap overflows, out-of-bounds read/write), path traversal, XSS, CSRF, SSRF, XXE, broken access control, code injection, cryptographic weaknesses, and information disclosure.

Severity is notably high across the set: four CVEs (CVE-2026-76964, CVE-2026-89103, CVE-2026-89126, CVE-2026-120017) carry the maximum CVSS v3 score of 10.0, and several others exceed 9.0, indicating unauthenticated or near-unauthenticated paths to arbitrary code execution, full system compromise, or significant data exposure. The advisory notes that some vulnerabilities require no authentication, while others exploit insufficient authorization or input validation. No public proof-of-concept exploits or in-the-wild exploitation are referenced in the advisory, though the technical descriptions suggest exploitation is feasible via specially crafted requests or input once details become public.

Defenders running affected SAP products should prioritize patching based on the published CVSS scores, starting with the CVSS 10.0 and 9.x-rated issues given their potential for remote code execution, authentication bypass, and full compromise of ABAP/Java-based SAP environments. As this is a primary vendor/CERT patch bulletin rather than a disclosed attack, there is no indication of active exploitation, but organizations should treat the critical-rated flaws as high priority given SAP's role as core business infrastructure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109793, CVE-2026-109794, CVE-2026-109795, CVE-2026-109797, CVE-2026-109798, CVE-2026-109799, CVE-2026-109800, CVE-2026-109801, CVE-2026-109802, CVE-2026-109803, CVE-2026-109804, CVE-2026-109805, CVE-2026-109806, CVE-2026-109807, CVE-2026-109809, CVE-2026-109810, CVE-2026-109811, CVE-2026-120008, CVE-2026-120009, CVE-2026-120010, CVE-2026-120012, CVE-2026-120013, CVE-2026-120014, CVE-2026-120015, CVE-2026-120016, CVE-2026-73635, CVE-2026-76964, CVE-2026-76965, CVE-2026-76966, CVE-2026-76970, CVE-2026-76973, CVE-2026-76976, CVE-2026-89103, CVE-2026-89114, CVE-2026-89115, CVE-2026-89119, CVE-2026-89125, CVE-2026-89126, CVE-2026-89128, CVE-2026-89129

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0485.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e9390659-3283-51c0-b5b7-f9ebe2604490/sap-patches-44-flaws-across-netweaver-products.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup