CVE-2026-120017

Published Nov 10, 2026

Last updated 3 days ago

CVSS critical 10.0
SAP

Overview

Description
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.
Source
cna@sap.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

cna@sap.com
CWE-347

Social media

Hype score
Not currently trending

  1. SAP fixed four CVSS 10 flaws on Nov 10: ICM2SHELL (CVE-2026-76964, -89126), PROXYGATE (CVE-2026-89103) and CVE-2026-120017. As of Nov 11, no attacks reported. Patch internet-facing Web Dispatcher and ICM first. #SAP 🇬🇧 https://t.co/bDVoMWslXf 🇩🇪 https://t.co/gBkpLKvl

    @DIESEC_GmbH

    13 Nov 2026

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. SAP's November Patch Day brings 35 new notes, including four CVSS 10.0 flaws in NetWeaver: ICM (CVE-2026-76964), Web Dispatcher (CVE-2026-89126), Gateway (CVE-2026-89103) and the ABAP SAML2 provider (CVE-2026-120017). No exploitation reported yet. https://t.co/qEgixgFApn

    @CipherSecurityN

    10 Nov 2026

    46 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨 SAP NetWeaver / Web Dispatcher — Kritik Güvenlik Açıkları! — CVE-2026-76964: ICM bellek bozulması / RCE — CVE-2026-89126: Web Dispatcher bellek bozulması / RCE — CVE-2026-89103: SAP Gateway erişim kontrolü açığı — CVE-2026-120017: SAML2 kimlik doğrula

    @ridvanyagli

    10 Nov 2026

    92 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. SAP fixed four CVSS 10.0 flaws (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) enabling pre-auth RCE and auth bypass in NetWeaver and Web Dispatcher. Restrict port 33xx now. https://t.co/HCGeiHJZcX https://t.co/QC14eBVf0C #2workly

    @2Workly

    10 Nov 2026

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2026-44772
  2. SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.•CVE-2026-89126
  3. SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.•CVE-2026-89103
  4. SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.•CVE-2026-76964
  5. SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.•CVE-2026-89107

References

Sources include official advisories and independent security research.