SAP November 2026 Patch Day

On November 10, 2026, SAP published its November 2026 Security Patch Day. The company says the release includes 35 new security notes, 4 GitHub security advisories, and 3 updates to previously released notes.

This is not a patch that every home computer needs. It matters if you, or the organization you work for, run the affected SAP products. If you do not operate those systems, you do not need to install anything from this Patch Day on your personal phone or laptop. If you do administer them, get the notes from the SAP Support Portal and apply the ones that match your landscape.

SAP’s post tells customers to visit the support portal and apply patches on priority to protect their SAP landscape. The public page does not say these issues are being exploited.

The four CVSS 10.0 notes

SAP’s public Patch Day table lists four notes at CVSS 10.0 (Critical). The product names and version families below are what that public table shows. The full notes typically live behind the SAP Support Portal, so treat the table as a starting point, not a complete install matrix, and confirm the exact patch for your systems there.

• Note 3778530, CVE-2026-76964: Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager). Public version families include KRNL64UC 7.53 and KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, and 9.20.
• Note 3778556, CVE-2026-89126: Memory Corruption vulnerability in SAP Web Dispatcher. Public version families include HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, and 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, and KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, and 9.20.
• Note 3798345, CVE-2026-89103: Broken Access Control in SAP Gateway. Public version families include KRNL64NUC 7.22 and 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, and 8.04, and KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, and 9.21.
• Note 3849308, CVE-2026-120017: Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider). Public version families include SAP_BASIS 702, 731, 740, 750 through 758, 816, 920, 921, and 922.

The same public table lists many more notes below a 10.0 score, including other NetWeaver, Web Dispatcher, and related product issues. Review the full November list rather than stopping at these four.

What to do if you run these products

Open the official November 2026 Security Patch Day page, then open each relevant note in the SAP Support Portal. Match the note to the product and version you actually run. Do not invent a patch level from the public family list alone, and do not assume every SAP system you have is in scope.

If you only use a website or an app that happens to be built on SAP somewhere in the background, wait for that provider to patch. This article is for people who can apply SAP notes, not a call for every reader to go looking for a download.