SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

SAP released its monthly security patch addressing four critical CVSS 10.0 vulnerabilities affecting the NetWeaver application server, Web Dispatcher, and Internet Communication Manager (ICM). The vulnerabilities include memory corruption flaws (CVE-2026-76964 and CVE-2026-89126) allowing unauthenticated remote code execution via crafted network traffic, alongside authentication bypasses in the SAML 2.0 service provider (CVE-2026-120017) and authorization bypasses in the SAP Gateway (CVE-2026-89103).

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai observes SAP Web Dispatcher and NetWeaver services exposed on external ports, matching their advertised version banners and server signatures against known vulnerabilities like CVE-2026-89126 and CVE-2026-76964.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain