VULNpocalypse
InformationalVulnerabilityMonitoring

CCCS reports SAP November 2026 rollup covering NetWeaver, Web Dispatcher

Canada’s Cyber Centre says SAP is affected by vulnerabilities in many products as of November 10, 2026; review SAP’s patch day notes and update.

Published
Exploitation
Not confirmed. The source does not mention exploitation.

What happened

According to the Canadian Centre for Cyber Security, SAP_SE is affected by vulnerabilities in a list of products as of November 10, 2026. The Cyber Centre published the notice as serial number AV26-1137, a monthly rollup. It says it encourages users and administrators to review the provided web link, which points to “SAP Security Patch Day - November 2026”, and to apply any necessary updates as they become available.

The CCCS notice is the only source for this story. It lists products and versions only. It does not give CVE identifiers, severity ratings, a description of the flaws or fixed versions. Those details are not confirmed here and should be read from SAP’s own patch day notes.

Products and versions the CCCS says are affected:

  • SAP NetWeaver AS ABAP (Internet Communication Manager): KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20.
  • SAP Web Dispatcher (several separate entries): versions including HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, and KERNEL 7.53 to 9.21 depending on the entry.
  • SAP Web Dispatcher and Internet Communication Manager: WEBDISP 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, KERNEL 7.93, 9.16, 9.20, 9.21.
  • SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher: WEBDISP 9.16, KERNEL 9.16, 9.20, 9.21.
  • SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher: WEBDISP 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.0, KERNEL 7.77, 7.93, 9.16.
  • SAP Gateway: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, and KERNEL 7.22 to 9.21.
  • SAP NetWeaver and ABAP Platform (several entries, including SAP Message Server): kernel component versions in the 7.22 to 9.21 range, and one entry listed only as “multiple versions”.
  • SAP NetWeaver Application Server (SAP Message Server) and SAP NetWeaver (SAP Message Server): kernel versions in the 7.22 to 9.21 range.
  • SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider): multiple versions.
  • SAP NetWeaver Knowledge Management (XML Forms): KMC-CM 7.50.
  • SAP NetWeaver AS Java EDM Application: CE-RA-EDM 7.50.
  • SAP NetWeaver (Internet Graphics Service), two entries: BC-FES-IGS 7.20EXT, 7.53, 7.54, 7.81, 9.16, plus 7.20_EX2 in one entry and 7.20_EXT2 in the other.
  • S4CRM: S4CRM 204, 205, 206, S4CEXT 107, 108, 109, BBPCRM 713, 714.
  • SAP BusinessObjects Business Intelligence Platform (Web Intelligence): ENTERPRISE 430, 2025, 2027.
  • SAP Host Agent: SAPHOSTAGENT 7.22.
  • SAP ABAP Developer Tools (AMDP Data Preview): multiple versions.
  • SAP Cloud SDK for Python: 0.63.1, 0.50.0.
  • SAP Cloud SDK for AI (JavaScript): v2.17.0.
  • SAP/astonish: v3.6.0.

Not confirmed in the source: which products carry the most serious flaws, whether any flaw is exploited, which versions contain the fixes, the severity of any flaw, and the CVE identifiers.

Am I affected?

You are potentially affected if you run any product above at a listed version. The CCCS lists most of these by kernel or component version, for example KERNEL 7.53 to 9.21, WEBDISP, KRNL64UC and KRNL64NUC. Two entries (SAML2 Service Provider, and one NetWeaver and ABAP Platform entry) and the AMDP Data Preview entry say only “multiple versions”, so you cannot judge exposure from the CCCS notice alone. Check those against SAP’s patch day notes.

The notice also lists SAP Cloud SDK for Python, SAP Cloud SDK for AI (JavaScript) and SAP/astonish at the versions named above. The CCCS does not say anything further about these entries.

What to do now

  1. Open SAP’s “SAP Security Patch Day - November 2026” notes, which the CCCS advisory references, and read the details for each product you run. The CCCS notice does not reproduce them.
  2. List your SAP systems and their kernel and component versions, then compare them with the product list above.
  3. For entries marked “multiple versions”, rely on SAP’s own notes to decide whether you are affected.
  4. Apply the updates SAP provides for the affected products, as the Cyber Centre advises, once they are available to you.
  5. Check SAP’s notes for fixed versions, severity and any workarounds. None of these is confirmed in the CCCS notice.

Sources