MeridianMeridian

SAP Patches Four CVSS 10.0 Flaws in NetWeaver, Web Dispatcher, Gateway and SAML

SAP released its November Security Patch Day fixes addressing four critical vulnerabilities, each rated CVSS 10.0, that require no authentication or user interaction to exploit. Two of the flaws, in the Internet Communication Manager and Web Dispatcher, allow remote code execution via crafted network traffic that corrupts memory. A third issue in the SAML 2.0 service provider permits attackers to impersonate any user, including privileged accounts, on systems using SAML single sign-on. The fourth flaw in SAP Gateway enables external attackers to bypass access controls and impersonate internal application servers. RedRays analysis stresses immediate kernel and Web Dispatcher updates across all instances and provides configuration guidance to reduce exposure until patches are applied.

The Hacker NewsTranslated from English

Read at source

SAP has issued fixes for four maximum-severity vulnerabilities as part of its November Security Patch Day. All four flaws carry a CVSS score of 10.0 and can be exploited by unauthenticated attackers over the network without any user interaction.

Three vulnerabilities affect the SAP NetWeaver application server and one resides in the Web Dispatcher. The flaws in the Internet Communication Manager (ICM) (CVE-2026-76964) and Web Dispatcher (CVE-2026-89126) allow remote code execution through specially crafted WebSocket control frames that trigger heap out-of-bounds writes.

The SAML 2.0 service provider flaw (CVE-2026-120017) lets attackers bypass signature validation on incoming assertions, enabling login as any user, including privileged accounts, on affected SAP NetWeaver AS ABAP systems that rely on SAML single sign-on for browser access such as Fiori Launchpad.

The SAP Gateway vulnerability (CVE-2026-89103) causes the component to fall back to overly permissive default access control lists, allowing an external attacker to be treated as one of the system’s own application servers and perform unauthorized actions.

Affected Components and SAP Notes

  • ICM: Note 3778530, multiple KERNEL versions from 7.53 to 9.20
  • Web Dispatcher: Note 3778556, covers HDB, WEBDISP, KERNEL and XS Advanced components
  • SAP Gateway: Note 3798345, affects KRNL64NUC/UC and KERNEL releases from 7.22 onward
  • SAML2: Note 3849308, impacts SAP_BASIS releases 702 through 922

RedRays recommends applying all kernel and Web Dispatcher updates in a single rollout and configuring gw/acl_mode_proxy, gw/acl_mode=1, and explicit secinfo/reginfo rules after patching. Disabling WebSocket support serves as a temporary mitigation but breaks ABAP Push Channels and certain Fiori features.

SAP NetWeaverWeb DispatcherCVE-2026-76964CVE-2026-89126CVE-2026-89103CVE-2026-120017
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
Vulns & Exploits

Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities

Apple has released multiple security updates addressing critical flaws in iMessage that could allow unauthorized access to group chat messages. One vulnerability, tracked as CVE-2026-113961, is an authorization issue that permitted remote attackers to join group chats and receive ongoing messages through improved validation fixes. A second issue, CVE-2026-113960, enabled newly added participants to access messages sent before they joined the conversation. The updates also resolve an out-of-bounds write flaw in Google's Brotli compression library, CVE-2026-111497, which CISA added to its Known Exploited Vulnerabilities catalog on October 27. Additionally, nine separate updates address multiple Bluetooth and AirPlay vulnerabilities that could enable unauthorized pairing or memory corruption without user interaction. The company has not confirmed active exploitation of the iMessage or Bluetooth issues and provided no workarounds for users unable to update immediately.

The Hacker NewsNov 10, 2026Translated from English

Attackers Exploit Critical Barracuda ESG Vulnerabilities for Root Access
Vulns & Exploits

Attackers Exploit Critical Barracuda ESG Vulnerabilities for Root Access

Barracuda Networks has warned that threat actors are actively exploiting two recently patched vulnerabilities in its Email Security Gateway appliances. The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, allow attackers to modify global configurations and execute operating system commands with root privileges. Exploitation requires access to the administrative user interface, prompting Barracuda to advise restricting Admin UI exposure to trusted internal networks. The company confirmed limited attacks against a small number of customers and urged immediate application of patches such as BNSF-40425. Historical context shows UNC4841 previously targeted similar Barracuda ESG zero-days, including CVE-2023-7102 and CVE-2023-2868, to deploy SeaSpy and Saltwater malware. Mandiant reported that nearly one-third of victims in the 2023 campaign were government agencies. Barracuda recommends enabling automatic patching to mitigate further risk across affected products including Load Balancer ADC and Web Application Firewall.

BleepingComputerNov 10, 2026Translated from English

CISA Adds Exploited IBM Aspera Faspex and SignalWire FreeSwitch Vulnerabilities to KEV Catalog
Vulns & Exploits

CISA Adds Exploited IBM Aspera Faspex and SignalWire FreeSwitch Vulnerabilities to KEV Catalog

The Cybersecurity and Infrastructure Security Agency warned that threat actors are actively exploiting critical flaws in IBM Aspera Faspex and SignalWire FreeSwitch. CVE-2026-123218 is an authorization bypass in Aspera Faspex that allows authenticated users to obtain full administrative privileges via crafted messages. IBM released version 5.0.19 PL1 to address the issue. CVE-2026-116779 affects SignalWire FreeSwitch and enables code injection leading to sensitive data disclosure, arbitrary call control, and command execution with the privileges of the FreeSwitch process. Both vulnerabilities were added to the Known Exploited Vulnerabilities catalog, requiring federal agencies to apply patches within three days. CISA also highlighted ongoing exploitation of a critical GPUStack authentication bypass and the SSHole flaw in OpenSSH.

SecurityWeekNov 10, 2026Translated from English