SAP NetWeaver Application Server e Web… · Disclosed

[Single source] SAP Patches Four CVSS 10.0 Flaws, Two Enabling Remote Code Execution

Nov 10, 2026 · 1 min read

SAP released fixes for four flaws rated 10.0, the maximum CVSS score, all exploitable without logging in; three affect the NetWeaver application server and one the Web Dispatcher, which receives web requests from the internet. Two of the flaws enable remote code execution. Administrators should apply the Security Patch Day updates.

By HIFY Radar newsroom Updated 11/10/2026 07:20 AM Get this every day →← Back to the feed 2 sources

HighVulnerabilityDisclosedPatched

In 30 seconds

Observed

SAP has shipped fixes for four security flaws that each scored 10.0, the absolute ceiling on the CVSS scale used to rate vulnerability severity. All four could be exploited without logging in, and all were addressed in the company's monthly Security Patch Day release. Three flaws sit in NetWeaver, the foundation software that SAP systems run on, and one is in the Web Dispatcher, the component that takes web requests from the internet and passes them along.

Observed

Two of the flaws enable remote code execution, which means an attacker could run their own commands on the server. Another could let an attacker log in as any user on certain SAML-enabled systems, and none of the four requires any action from a victim.

What happened

Observed

The fixes arrived as part of SAP's regular monthly Security Patch Day. The vendor rates all four vulnerabilities 10.0, the maximum CVSS score, and states that attackers could exploit each one without authenticating. Three affect the NetWeaver application server and one affects the Web Dispatcher, the internet-facing component that receives web requests and forwards them to that server.

Observed

The Hacker News followed its report with a post on X that filled in the impact. According to that post, two of the flaws could allow remote code execution without authentication, another could let attackers log in as any user on certain SAML-enabled systems, and no user interaction is required for any of them.

Why it matters

Inferred

A 10.0 is the worst rating the CVSS scale can give, and the details here explain why. The flaws need no credentials and no click from a victim, which removes the two most common barriers to exploitation. What remains is largely a question of how reachable the vulnerable systems are.

Inferred

Reachability is the real worry. The Web Dispatcher is the piece that sits closest to the open internet, accepting web requests and handing them to the application server behind it, so a flaw there can sit directly in the path of anyone scanning the web.

What to do

Inferred

The immediate move is to apply SAP's Security Patch Day updates, with NetWeaver application servers and any Web Dispatcher exposed to the internet first in line. These fixes shipped through the routine monthly channel, so teams that normally batch SAP patches should treat this month's set as urgent rather than deferred.

Inferred

Systems using SAML for logins deserve a specific check, since one of the patched flaws reportedly allows signing in as any user on affected setups.

Confirmed and still uncertain

Observed

Established so far: four flaws, all rated 10.0, all exploitable without authentication and without user interaction. Three are in the NetWeaver application server and one is in the Web Dispatcher. Two enable remote code execution and one allows logging in as any user on SAML-enabled systems.

Inferred

Not yet clear from the available reporting: the impact of the fourth flaw is not described, the specific CVE numbers are not listed, and there is no evidence so far that any of these vulnerabilities has been exploited in the wild.

What people are saying

Observed

The Hacker News flagged the batch on X with a warning tone. Its post opens with "SAP patches 4 vulnerabilities rated CVSS 10.0 in NetWeaver and Web Dispatcher" and highlights that two could allow remote code execution without authentication.

Observed

The same post stresses that another flaw could let attackers log in as any user on certain SAML-enabled systems, and closes on the point that no user interaction is required. No voices beyond this outlet appear in the current evidence batch.

Evolution

Observed

The story broke with The Hacker News' report on the patch release, which notes the flaws were fixed as part of SAP's monthly Security Patch Day rather than an out-of-band emergency fix. That routine channel carrying four maximum-severity flaws is itself part of the story.

Observed

Minutes after the article published, the outlet's X account amplified the report and added the SAML detail, framing the two remote code execution flaws and the any-user login risk as the headline dangers. No further updates or independent confirmations appear in the evidence so far.

Reach

Observed

1 independent groups, 2 updates, and 2 engagements.

Technical detail

Observed

CVSS is the industry's shared 0-to-10 scale for rating how severe a vulnerability is, and 10.0 is the top of that scale. All four SAP flaws hit the ceiling, and all are reported as exploitable without authentication and without user interaction.

Observed

On the architecture side, NetWeaver is the application server platform that SAP systems run on, and the Web Dispatcher sits in front of it as the entry point that receives web requests from the internet and passes them to that server.

Observed

The SAML angle matters because SAML is a standard used for single sign-on logins. According to the outlet's post, one of the flaws could let an attacker authenticate as any user on systems where SAML is enabled, effectively bypassing login altogether.

Sources and evidence

Observed

This briefing rests on two items from the same outlet: The Hacker News article published alongside the patch release, which serves as the primary source, and the outlet's follow-up post on X that adds the SAML detail. Both are cited throughout, and the second should be read as the outlet's own reporting rather than independent confirmation.

Inferred

One caveat on completeness: the article text available in this batch cuts off mid-sentence where the Web Dispatcher flaws are described. Specifics of that flaw, the CVE identifiers, and any vendor workarounds are therefore not yet verifiable from the included evidence.