SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

SAP identified and patched four critical vulnerabilities all scoring the maximum CVSS 10.0, including two that allow unauthenticated remote code execution in the Internet Communication Manager and Web Dispatcher. These components are often internet-facing, meaning exploitation requires no user interaction and can be performed by any attacker who can reach the service. The remaining two flaws enable unauthorized actions and user impersonation via SAP Gateway and the SAML 2.0 service provider, compounding the risk of full system compromise. Organisations running unpatched SAP environments face catastrophic exposure, as attackers can chain these vulnerabilities to gain initial access, escalate privileges, and impersonate legitimate users. The incident underscores the critical importance of applying vendor patches immediately for maximum-severity flaws in enterprise middleware.