# SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

Source: [The Hacker News](https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html) · 2026-11-10 · Security
Page: https://themorning.dev/story/sap-patches-four-cvss-10-0-flaws-including-two-enabling-remote-code-execution-ce0b470d4dea056e
Kind: security · Impact: high

## In brief

- SAP fixed four flaws rated CVSS 10.0, the maximum score, as part of its monthly Security Patch Day.
- The flaws can be exploited without logging in.
- Three flaws are in the SAP NetWeaver application server; the fourth is in a product the source text does not name, and two of the four enable remote code execution.

## Why it matters

Unauthenticated flaws rated at the maximum CVSS score, including remote code execution, can give attackers control of SAP systems if they are not patched.

## What to do

- Apply SAP's Security Patch Day fixes for the four CVSS 10.0 flaws

## Timeline

- 2026-11-10: SAP fixed four CVSS 10.0 flaws as part of its monthly Security Patch Day

## Coverage

- [SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution](https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html) — The Hacker News, 2026-11-10

Tags: sap, security, vulnerability, patch, netweaver, remote-code-execution

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev