{
  "id": 19318901,
  "title": "SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution",
  "url": "https://urgent.news/2026/11/10/sap-patches-four-cvss-10-0-flaws-including-two-enabling-remote-code",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T10:02:40.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html"
  },
  "original_language": "en",
  "account": "SAP released a monthly Security Patch Day update addressing four critical vulnerabilities, all rated at the maximum CVSS score of 10.0. The flaws affect three components of the SAP NetWeaver application server and one in the Web Dispatcher. The Web Dispatcher and Internet Communication Manager (ICM) flaws could enable an attacker to execute code remotely if they can access the software over the network. The ICM flaw allows an attacker to log in as any user on certain systems with SAML single sign-on. The SAP Gateway flaw could allow an attacker to impersonate one of the system's servers and perform unauthorized actions. None of the vulnerabilities require user interaction to exploit. SAP urges users to apply the patches promptly, available in SAP for Me. RedRays, a security firm, recommends updating the kernel and all Web Dispatchers in a single rollout, covering all fixes for this month.",
  "summary": "Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server. The flaws in the Web",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "TechRepublic",
        "title": "November 2026 Android Security Update Fixes 3 Critical Remote Code Execution Flaws",
        "url": "https://urgent.news/2026/11/09/november-2026-android-security-update-fixes-3-critical-remote-code",
        "published": "2026-11-09T15:07:33.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}