SAP has released security updates addressing four critical vulnerabilities, all rated with a CVSS score of 10.0, the highest possible. These vulnerabilities can be exploited without requiring user authentication, posing significant risks to systems if left unpatched.
Details of the Vulnerabilities
Three of the vulnerabilities are located within the SAP NetWeaver application server, which forms the backbone of SAP systems, while another resides in the SAP Web Dispatcher. The Web Dispatcher vulnerability, along with a flaw in the Internet Communication Manager (ICM), allows potential attackers to execute arbitrary code over the network, as reported by SAP.
Additionally, the SAML 2.0 service provider vulnerability could enable unauthorized access, permitting an attacker to log in as any user on systems utilizing SAML single sign-on. Another flaw in the SAP Gateway could allow an attacker to impersonate system servers, facilitating unauthorized actions.
Impact and Affected Versions
Each vulnerability is addressed in separate SAP notes, with specific affected versions detailed in SAP’s latest security bulletin. These notes are accessible through SAP for Me, a portal that necessitates user login. SAP strongly advises prioritizing these updates to mitigate potential security breaches.
Notable vulnerabilities include CVE-2026-76964 affecting the ICM and CVE-2026-89126 impacting the Web Dispatcher. These could lead to memory corruption through crafted network traffic, enabling code execution and full system compromise. The SAML vulnerability (CVE-2026-120017) could result in unauthorized access to privileged user accounts, escalating the threat to connected systems.
Recommended Actions
RedRays, a security consultancy firm, recommends a comprehensive update of all kernels and Web Dispatchers to incorporate the recent fixes. The firm advises against relying on temporary workarounds, as the only effective solution is to implement the correction instructions from SAP.
For SAML2 vulnerabilities, SAP advises reviewing trusted identity providers and checking audit logs for unexpected logon activity. The SAP Gateway issue requires explicit rule settings for secinfo and reginfo, while the ICM and Web Dispatcher flaws necessitate patching or disabling WebSocket support as a last resort.
In conclusion, addressing these vulnerabilities promptly is crucial to maintaining the security and integrity of SAP systems. Organizations using affected components should apply the patches without delay to protect against potential exploits.
