SAP Patches Four CVSS 10.0 Flaws in NetWeaver, Web Dispatcher, Gateway and SAML
SAP released its November Security Patch Day fixes addressing four critical vulnerabilities, each rated CVSS 10.0, that require no authentication or user interaction to exploit. Two of the flaws, in the Internet Communication Manager and Web Dispatcher, allow remote code execution via crafted network traffic that corrupts memory. A third issue in the SAML 2.0 service provider permits attackers to impersonate any user, including privileged accounts, on systems using SAML single sign-on. The fourth flaw in SAP Gateway enables external attackers to bypass access controls and impersonate internal application servers. RedRays analysis stresses immediate kernel and Web Dispatcher updates across all instances and provides configuration guidance to reduce exposure until patches are applied.
The Hacker NewsNov 10, 2026Translated from English