SAP's monthly Security Patch Day landed on 10 November 2026 with 35 new security notes and four GitHub security advisories. Buried in that list are four flaws that deserve your immediate attention: all four score a perfect 10.0 on the CVSS severity scale, the maximum possible, and none of them require an attacker to log in first.
That last point is what makes this different from routine patching. Most software vulnerabilities need a valid account, a tricked user, or some other foothold before they can be exploited. These four do not. If your SAP system is reachable from the internet, and many are because finance teams, suppliers or remote staff need access, an attacker can potentially take it over the same day the flaw becomes public knowledge.
What exactly is broken
According to The Hacker News, three of the four maximum-severity flaws sit in SAP NetWeaver, the application server that underpins most SAP systems, and one is in the Web Dispatcher, the component that receives web requests from the internet and forwards them to that server. The Web Dispatcher flaw, together with a separate issue in the Internet Communication Manager (ICM) that handles web traffic, could let an attacker who can simply reach the software over the network execute code on it.
The fourth flaw, tracked as CVE-2026-120017, is a missing authentication issue in the SAML2 Service Provider within SAP NetWeaver AS ABAP and the ABAP Platform, as reported by Cybersecurity News. SAML2 is commonly used for single sign-on, so a flaw here can potentially let an attacker impersonate a legitimate user without ever providing a password.
On top of these four, CyberPress reports three more critical issues in the same release scoring 9.9 out of 10, covering code injection, OS command injection and a missing authorization check. These are only marginally less dangerous and should be patched in the same pass.
Why this matters for Swiss businesses specifically
SAP is not a niche product in Switzerland. It runs ERP, finance and HR for SMEs and large corporates alike — Geneva Airport, for instance, has just announced it is moving to SAP. Any organisation with an internet-facing SAP component, whether that's a Web Dispatcher exposed for remote access, a portal for suppliers, or an SSO login page, is a same-day takeover risk until these notes are applied.
What to do today
- Identify your exposure. Check whether your SAP NetWeaver, Web Dispatcher or Gateway components are reachable from the internet, directly or through a reverse proxy.
- Apply SAP's November 2026 Patch Day notes immediately for the four CVSS 10.0 flaws and the three 9.9-rated issues. Treat this as an out-of-cycle emergency patch, not routine maintenance.
- Check your SAML2 / SSO configuration on NetWeaver AS ABAP for the missing authentication issue specifically — this one can bypass login entirely.
- Review firewall and network segmentation so that SAP application servers are not directly exposed where a Web Dispatcher or reverse proxy could do the job instead.
- Ask your SAP partner or internal admin to confirm patch status in writing, with a date, rather than assuming it has been applied.
If you don't run SAP in-house but a finance, payroll or logistics partner does, it is worth a quick call to ask whether their systems are patched. Supply-chain exposure through a vendor's SAP environment is just as real as exposure through your own.
The bigger picture
This is the kind of patch-day news that business owners rarely see until it's too late. Critical vulnerabilities in widely used enterprise software are now surfacing on a near-weekly basis, and the gap between disclosure and active exploitation keeps shrinking. We track these developments as they happen and will keep reporting the ones that matter most to Swiss businesses.
If you don't have the in-house resources to monitor patch days, verify exposure, and apply fixes quickly, that's exactly where outside IT support earns its keep. TMC (The Mejlerö Company GmbH) provides IT support for SMEs in Obwalden, Nidwalden, Lucerne and Zurich, including network and security checks, Microsoft 365 administration and endpoint protection basics such as two-factor authentication. A free network analysis and a free one-hour consultation are available if you want a second set of eyes on your setup before the next patch day lands.
Switzerland.