[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvszxlx7IH0upnRoRC8PHiNH_XBEI4B8nUj4QwI-MbYA":3},{"article":4,"iocs":44,"watch_terms":58,"solutions":59,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"b59c0918-39ab-41e8-b684-91f6de9a93c5","SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution","sap-patches-four-cvss-10-0-flaws-including-two-enabling-remote-code-execution-c110ef","Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server. The flaws in the Web","SAP has released patches for four critical vulnerabilities, all rated CVSS 10.0, the highest possible score. Two of these flaws, located in the Internet Communication Manager (ICM) and SAP Web Dispatcher, allow for remote code execution without any user interaction. The other two vulnerabilities affect SAP Gateway and the SAML 2.0 service provider, enabling unauthorized actions and user impersonation, respectively.","SAP patches four critical CVSS 10.0 flaws, two enabling remote code execution.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fsap-patches-four-cvss-100-flaws.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgo4snqwJ4uD_sRDyI8zs23mcfFTWfZoSrn9n1hbUrsHbyWy-1VFL8amxqQnLb7LSTPkuSwnsPofUJT6anObg-nU4Q5e01WBb3IixN_PdL-1MJ2nOip4qSTEoVDmePRlOgjSVjvtbH8vFlQgxtGuKuqmuHWLyzIavw2Sj4VtZBlTYhUqeySbQcDMEr4Wns\u002Fs1600\u002Fsap-flaws.jpg","2026-11-10T10:02:40+00:00","2026-11-10T11:00:27.343236+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"SAP","vendor",{"name":21,"type":22},"SAP NetWeaver","product",{"name":24,"type":22},"SAP Web Dispatcher",{"name":26,"type":22},"Internet Communication Manager (ICM)",{"name":28,"type":22},"SAP Gateway",{"name":30,"type":22},"SAML 2.0 service provider","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},[45,49,52,55],{"type":46,"value":47,"context":48},"cve","CVE-2026-76964","Critical flaw in Internet Communication Manager (ICM), SAP NetWeaver AS ABAP.",{"type":46,"value":50,"context":51},"CVE-2026-89126","Critical flaw in SAP Web Dispatcher.",{"type":46,"value":53,"context":54},"CVE-2026-89103","Critical flaw in SAP Gateway.",{"type":46,"value":56,"context":57},"CVE-2026-120017","Critical flaw in SAML2 service provider, SAP NetWeaver AS ABAP and ABAP Platform.",[18,21,24],{"controls":60,"vendors":144},[61,90,115],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,107],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":91,"product_name":104,"url":105,"description":106},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":116,"name":117,"problem":118,"products":119},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"sap-releases-patches-for-four-cvss-100-flaws-enabling-remote-code-execution","SAP Releases Patches for Four CVSS 10.0 Flaws Enabling Remote Code Execution","SAP identified and patched four critical vulnerabilities all scoring the maximum CVSS 10.0, including two that allow unauthenticated remote code execution in the Internet Communication Manager and Web Dispatcher. These components are often internet-facing, meaning exploitation requires no user interaction and can be performed by any attacker who can reach the service. The remaining two flaws enable unauthorized actions and user impersonation via SAP Gateway and the SAML 2.0 service provider, compounding the risk of full system compromise. Organisations running unpatched SAP environments face catastrophic exposure, as attackers can chain these vulnerabilities to gain initial access, escalate privileges, and impersonate legitimate users. The incident underscores the critical importance of applying vendor patches immediately for maximum-severity flaws in enterprise middleware.",[150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":158,"PCI DSS Requirement 6":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"OWASP A06:2021 Vulnerable and Outdated Components":161,"CIS Control 7: Continuous Vulnerability Management":162,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":163,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":164},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the CVSS 10.0 severity of these SAP flaws triggers mandatory rapid response obligations under this article.","PCI DSS Requirement 6 mandates that organisations develop and maintain secure systems by applying security patches promptly, directly applicable where SAP systems process payment-related data and face these critical unpatched flaws.","SI-2 requires organisations to identify, report, and correct information system flaws; applying SAP's patches promptly under a formal flaw remediation process directly addresses all four critical vulnerabilities.","The SAP components in question contained known, vendor-confirmed vulnerabilities; OWASP A06 specifically highlights the risk of running software with unpatched critical flaws and calls for continuous monitoring of component versions.","Regular scanning and a defined remediation SLA would have ensured these CVSS 10.0 SAP flaws were identified and patched immediately upon SAP's advisory release, before attackers could exploit them.","This control mandates timely identification and remediation of technical vulnerabilities in information systems, which would have driven patching of the SAP ICM and Web Dispatcher flaws before exploitation.","The SAML 2.0 and SAP Gateway flaws enable user impersonation and unauthorized actions, which robust identity and access controls — as required by PR.AA — would help detect and limit even if the vulnerability was exploited."]