Daily brief 2026-11-10: CVE-2026-109795 and what businesses should patch

CVE-2026-109795 (CVE-2026-109795): SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input v. Severity CRITICAL, CVSS 9.9, EPSS n/a.

CVE-2026-109803 (CVE-2026-109803): SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selectio. Severity CRITICAL, CVSS 9.9, EPSS n/a.

CVE-2026-120017 (CVE-2026-120017): SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incomi. Severity CRITICAL, CVSS 10, EPSS n/a.

CVE-2026-76964 (CVE-2026-76964): SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input. Severity CRITICAL, CVSS 10, EPSS n/a.

CVE-2026-76965 (CVE-2026-76965): SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authori. Severity CRITICAL, CVSS 9.9, EPSS n/a.

CVE-2026-89103 (CVE-2026-89103): SAP Gateway activates the default Access Control List with high privileges allowing catego. Severity CRITICAL, CVSS 10, EPSS n/a.

None of today's entries map to our featured business applications, but check your asset list against the vendors above.

Prioritize anything in CISA KEV and anything internet-facing (VPNs, firewalls, web servers, remote-support tools). Confirm patch status across every client tenant, and kill active sessions after patching gateway appliances.

No web-application entries lead today. Keep CMS cores, plugins and themes on auto-update and protect admin logins with MFA.

Ask your IT provider which of these products you run, and get written confirmation they are patched or mitigated.

Enforce MFA, keep tested offline backups, and make sure remote access is not exposed without protection.