cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

SAP Fixes Four Maximum-Severity Flaws, Including Two That Could Enable Remote Code Execution

· Original article ↗

Summary

SAP fixed four CVSS 10.0 flaws in NetWeaver and Web Dispatcher that reportedly require no login or user action. Two could enable remote code execution; others could allow privileged SAML logins or unauthorized SAP Gateway actions.

Key points

  • SAP says all four flaws are CVSS 10.0 and require no user action; the article says they can be exploited without logging in.
  • CVE-2026-76964 in the Internet Communication Manager and CVE-2026-89126 in Web Dispatcher could allow remote code execution through crafted network traffic.
  • CVE-2026-120017 could allow attackers to log in as users, including privileged users, on some systems using SAML single sign-on.
  • CVE-2026-89103 could let an external attacker impersonate an SAP application server and take unauthorized actions through the Gateway.
  • SAP recommends prioritizing the fixes. RedRays advises updating the kernel and all Web Dispatchers in one rollout.

Article Details

Vulnerability Types
  • Remote code execution
  • Memory corruption
  • SAML authentication bypass
  • Authorization bypass through privileged access-control defaults
Severity
CVSS 10.0 for each of the four flaws
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article says an external attacker can reach the SAP Web Dispatcher and Internet Communication Manager over the network and exploit their flaws to run code.

CVE

CVE-2026-120017Vendor / Product unavailableOn the affected SAML setups, an attacker could use CVE-2026-120017 to log in as privileged users too, according to the vendor. A full compromise could follow, possibly reaching connected systems.CVE-2026-44748Vendor / Product unavailableA different SAML flaw in the same software, CVE-2026-44748, was fixed on June 9 and needed an attacker with a normal user account.CVE-2026-76964Vendor / Product unavailableIn the ICM flaw (CVE-2026-76964) and the Web Dispatcher flaw (CVE-2026-89126), crafted network traffic could corrupt memory. An attacker who succeeds could then run code and fully compromise the system.CVE-2026-89103Vendor / Product unavailablecontrol lists to decide which outside programs may connect to it and which programs it may start. In CVE-2026-89103, the gateway enables its default list with high privileges, allowing an external attacker to beCVE-2026-89126Vendor / Product unavailableIn the ICM flaw (CVE-2026-76964) and the Web Dispatcher flaw (CVE-2026-89126), crafted network traffic could corrupt memory. An attacker who succeeds could then run code and fully compromise the system.

Vendors

SAPFour flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.

Products

Internet Communication ManagerThe flaws in the Web Dispatcher and the Internet Communication Manager (ICM), which handles the server's web traffic, could allow an attacker who can reach the software over the network to run code, the vendor says.SAP GatewayThe flaw in SAP Gateway, which connects the server to other SAP systems and programs, could allow an attacker to impersonate one of the system's own servers and take unauthorized actions.SAP NetWeaverThree are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.Web DispatcherThree are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.

Related Articles