SAP patches four CVSS 10.0 flaws in NetWeaver and Web Dispatcher

# SAP patches four CVSS 10.0 flaws in NetWeaver and Web Dispatcher

https://gcdradar.vercel.app/incidents/sap-patches-four-cvss-10-0-flaws-in-netweaver-and-web-dispat · AIR-2026-1852 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical rating of 10.0 with patches available.
- Fix status: Patched
- First reported: 2026-11-10
- AI role: No AI role
- Products: SAP NetWeaver, SAP Web Dispatcher
- CVSS: 10

## Summary

SAP fixed four critical unauthenticated remote code execution and related flaws in NetWeaver application servers and the Web Dispatcher. All four vulnerabilities carry the maximum CVSS score of 10.0 and were addressed in the monthly Security Patch Day.

## What to do

Apply the November 2026 SAP security updates to the Gateway component.

## Latest updates

- 2026-11-10: SAP's November 2026 update also patched a maximum‑severity flaw in the Gateway component, expanding the scope beyond NetWeaver and Web Dispatcher. (https://bleepingcomputer.com/news/security/sap-patches-four-maximum-severity-security-vulnerabilities)
- 2026-11-10: SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution (https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html)

## Sources

- 2026-11-10 The Hacker News: SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html
- 2026-11-10 BleepingComputer: SAP patches ICM2SHELL and PROXYGATE maximum severity flaws https://bleepingcomputer.com/news/security/sap-patches-four-maximum-severity-security-vulnerabilities
- 2026-11-10 SecurityWeek: SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities https://securityweek.com/sap-patches-critical-icm2shell-proxygate-vulnerabilities

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.