SAP Product Security Update Recommendation

Overview

A security update has been released to address a vulnerability in an SAP product. If you are using this product, you must apply the latest version or a separate security patch.

Affected Products and Vulnerabilities

• CVE-2026-76964. This is a memory corruption vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager). Affected versions are KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, and 9.20.
• CVE-2026-89103. This is an improper authorization vulnerability in SAP Gateway. Affected versions are KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, 8.04, KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.20, and 9.21. – CVE-2026-89126. A memory corruption vulnerability occurring in SAP Web Dispatcher. Affected versions are HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XSADVANCEDRUNTIME 1.00, SAPEXTENDEDAPPSERVICES 1, KERNEL 7.53, 9.18, and 9.20. – CVE-2026-120017. This is a vulnerability involving insufficient verification of encrypted signatures in SAP NetWeaver AS ABAP and the ABAP Platform (SAML2 Service Provider). Affected versions include SAPBASIS 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 920, 921, and 922.

Response

Vulnerability Patches have been provided through the latest update, and you must update to the latest version with the Vulnerability Patches by following the instructions on the reference website. Each item has been identified as requiring a separate security patch.